# nmap -a -t4 scanme nmap

Host Discovery

• Reduce the number of hosts on a network to be scanned
• Specify how each host is to be identified as interesting
• Firewall considerations
• Default: Each requested IP address
• Attempt – TCP ACK to port 80
• Attempt – ICMP Echo Request

Host Discovery

• Some available host discovery options:
• sL (List Scan)
• sP (Ping Scan)
• Use only pings to scan the IP addresses specified
• Prints all host responding to a ping
• P0 (No Ping)
• PS [port list] (TCP SYN Ping Scan)
• TCP SYN Packet sent to port 80 for every IP
• Else to every port in the list
• PA [port list] (TCP ACK Ping Scan)
• PU [port list] (UDP Ping Scan)
• PE; -PP; -PM (ICMP Ping Scan)
• PR (ARP Ping Scan)