Before port scanning, Nmap needs to answer a simpler question: which systems are actually online? This room focuses on Nmap’s host discovery stage and the different protocols it can use to detect live targets without wasting time scanning dead hosts.
Core idea: host discovery reduces noise and saves time by proving a target is up before you move on to service enumeration.
Nmap accepts multiple target formats, so you can scan exactly what you intend.
MACHINE_IP scanme.nmap.org example.com10.11.12.15-20MACHINE_IP/30nmap -iL list_of_hosts.txtPreview mode: use nmap -sL TARGETS to list what Nmap would scan without actually scanning. Add -n if you do not want reverse DNS lookups.
Nmap can use several protocols to discover live hosts, depending on where you are positioned and what is being filtered.
Rule of thumb: any response is useful. You often do not care what the port state is yet, only that the host answered somehow.
ARP host discovery works only on the local subnet because ARP is a link-layer protocol and does not cross routers.
sudo nmap -PR -sn MACHINE_IP/24Related tool: arp-scan -l performs a similar job using ARP requests and is very useful on local networks.
ICMP is the classic way to probe for live systems, but firewalls often block some or all of these request types.
sudo nmap -PE -sn MACHINE_IP/24sudo nmap -PP -sn MACHINE_IP/24sudo nmap -PM -sn MACHINE_IP/24Important: if one ICMP method fails, that does not prove the host is down. It may only mean that this ICMP type is filtered somewhere along the path.
TCP SYN ping sends SYN probes to selected ports and watches for any TCP response. Open ports may return SYN/ACK; closed ones may return RST. Either response proves the host is up.
sudo nmap -PS22,80,443 -sn MACHINE_IP/30ACK ping sends TCP packets with the ACK flag set. Because the packet does not belong to an existing session, a reachable host often answers with RST, proving it is online.
sudo nmap -PA22,80,443 -sn MACHINE_IP/30Why use it: some filtering devices react differently to ACK probes than to SYN or ICMP, so ACK ping gives you another path to host discovery.
UDP ping does not rely on a normal application reply. Instead, it often works by hitting a closed UDP port and waiting for an ICMP port unreachable response, which proves the host is alive.
sudo nmap -PU53,161,162 -sn MACHINE_IP/30Key point: an open UDP port may stay silent, so closed-port ICMP errors are often more helpful than successful application responses here.
When no special host discovery flags are supplied, Nmap chooses different techniques depending on privilege level and whether the target is local or remote.
Host discovery only: add -sn if you want to stop after live-host detection and avoid any port scanning.
By default, Nmap performs reverse DNS lookups on online hosts. This can reveal useful hostnames, but it also creates extra DNS traffic.
nmap -n TARGETS
nmap -R TARGETS
nmap --dns-servers DNS_SERVER TARGETS-n: no DNS lookups-R: reverse DNS for all hosts, even offline ones--dns-servers: choose the DNS server explicitlyThe room also mentions tools that overlap with Nmap’s discovery stage:
Caution: Masscan is extremely noisy compared with standard Nmap usage, so it is powerful but easy to misuse.
sudo nmap -PR -sn MACHINE_IP/24
sudo nmap -PE -sn MACHINE_IP/24
sudo nmap -PP -sn MACHINE_IP/24
sudo nmap -PM -sn MACHINE_IP/24
sudo nmap -PS22,80,443 -sn MACHINE_IP/30
sudo nmap -PA22,80,443 -sn MACHINE_IP/30
sudo nmap -PU53,161,162 -sn MACHINE_IP/30-sn when you only want live host discovery and not a follow-up port scan.-n when you do not want reverse lookups.