> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/enum/network-discovery/host-discovery.md).

# Host Discovery

## Host discovery with nmap

If no host discovery options are given, Nmap sends an **ICMP echo request**, a **TCP SYN packet to port 443**, a **TCP ACK packet to port 80**, and an **ICMP timestamp request**. (For IPv6, the ICMP timestamp request is omitted because it is not part of ICMPv6.) These defaults are equivalent to the `-PE -PS443 -PA80 -PP` options. The exceptions to this are the ARP (for IPv4) and Neighbor Discovery (for IPv6) scans which are used for any targets on a local ethernet network. For **unprivileged** Unix shell users, the **default probes are a SYN packet to ports 80 and 443** using the `connect` system call. This host discovery is often sufficient when scanning local networks, but a more comprehensive set of discovery probes is recommended for security auditing.

The `-P*` options (which select ping types) can be combined. You can increase your odds of penetrating strict firewalls by sending many probe types using different TCP ports/flags and ICMP codes. Also note that ARP/Neighbor Discovery is done by default against targets on a local Ethernet network even if you specify other `-P*` options, because it is almost always faster and more effective.

By default, Nmap does host discovery and then performs a port scan against each host it determines is online. This is true even if you specify non-default host discovery types such as UDP probes (`-PU`). Read about the `-sn` option to learn how to perform only host discovery, or use `-Pn` to skip host discovery and port scan all target addresses. The following options control host discovery:

* `-sL` (List Scan)
* `-sn` (No port scan)
* `-Pn` (No ping)
* `-PS`` `*`<port list>`* (TCP SYN Ping)
* `-PA`` `*`<port list>`* (TCP ACK Ping)
* `-PU`` `*`<port list>`* (UDP Ping)
* `-PY`` `*`<port list>`* (SCTP INIT Ping)
* `-PE`; `-PP`; `-PM` (ICMP Ping Types)
* `-PO`` `*`<protocol list>`* (IP Protocol Ping)
* `--disable-arp-ping` (No ARP or ND Ping)

## Resources

Host Discovery - Nmap.org: <https://nmap.org/book/host-discovery.html>

Host Discovery - Nmap Reference Guide: <https://nmap.org/book/man-host-discovery.html>

nmap - Linux manual page: <https://linux.die.net/man/1/nmap>