Nmap Ping Scans for Host Discovery

1. What is Nmap and Host Discovery?

Before we run our first command, let's establish what we're doing and why. In any ethical hacking engagement, after you've identified potential targets (reconnaissance), you need to confirm they exist and are reachable on the network (scanning).

Nmap is the industry-standard tool for this. It's a free and open-source utility for network discovery and security auditing. System administrators use it to inventory network devices, and penetration testers use it to find live hosts, open ports, running services, and operating systems.

Host discovery, also known as a "ping scan," is Nmap's function for identifying which IP addresses on a network belong to active devices.

As you read, the key takeaway is that host discovery lets us filter a large list of potential targets down to a smaller, confirmed list of live systems. This makes subsequent, more intensive scans much more efficient.

2. The Ping Scan: nmap -sn

The primary command for host discovery is nmap -sn. Let's break it down:

• nmap: The program itself.
• -sn: This is the option for a "ping scan." It tells Nmap: "Discover which hosts are online, but do not perform a port scan."

This is an important distinction. A full port scan can be time-consuming and noisy (i.e., easily detected). A ping scan is much faster and lighter, as its only goal is to get a "yes" or "no" answer to the question, "Is anyone at this IP address?"

You can provide targets to Nmap in several ways, which should feel familiar from your work with other command-line tools:

• Single IP: nmap -sn 192.168.1.1
• Hostname: nmap -sn scanme.nmap.org
• Subnet (CIDR notation): nmap -sn 192.168.1.0/24 (scans all 256 addresses from 192.168.1.0 to 192.168.1.255)
• IP Range: nmap -sn 192.168.1.1-50

The output is a simple list of hosts that responded.

3. Hands-On Lab: Discovering Hosts in Your Lab

Theory is great, but let's apply this in your virtual lab. Make sure your Kali Linux and Metasploitable2 VMs are running on the same virtual network.

1. Find your network range:

   • On your Kali VM, open a terminal and run ip a.
   • Look for your primary network interface (e.g., eth0). Find the inet address, which will look something like 192.168.56.101/24.
   • The /24 tells you the subnet is 192.168.56.0/24. Your network may be different.

2. Perform a ping sweep:

   • Run the nmap -sn command against the entire subnet you just identified. Remember to use sudo for some scan types to work correctly.
   • sudo nmap -sn 192.168.56.0/24 (replace with your actual subnet).

You should see a list of active hosts. This will include your Kali machine, your Metasploitable2 target, and possibly the virtual network's gateway. You have now successfully mapped the live devices in your lab environment!

4. How "Ping Scans" Really Work

Here's a crucial detail for any aspiring hacker: an Nmap "ping scan" doesn't just use the standard ping command (which sends ICMP echo requests). Relying only on ICMP is a bad strategy because many systems and firewalls are configured to ignore it.

Nmap is much smarter. When you run nmap -sn as root, it sends a combination of probes to maximize the chance of getting a response:

• ARP Ping (-PR): On a local network (like your lab), Nmap sends ARP requests. This is the most reliable method for local host discovery because ARP is a fundamental protocol for Ethernet communication and is almost never blocked internally.
• ICMP Echo Request (-PE): The standard "ping."
• TCP SYN Ping (-PS): It sends a TCP packet with the SYN flag set to a specific port (by default, port 443). If the host responds with a SYN/ACK or a RST packet, Nmap knows it's online.
• TCP ACK Ping (-PA): It sends a TCP packet with the ACK flag set (by default, to port 80). An online host should respond with a RST packet.

The key idea is that even if a firewall blocks one type of probe (like ICMP), another might get through.

5. When Hosts Don't Respond: The -Pn Flag

What happens when a target is online but is behind a strict firewall that blocks all of your host discovery probes? Nmap will incorrectly report that the host is down.

For these situations, we have the -Pn flag. This powerful option tells Nmap: "Don't even try to discover the host. Assume it's online and proceed directly to the next steps (like port scanning)."

The syntax is simple: nmap -Pn <target>

You use -Pn when you have strong reason to believe a host is online, even if it's not responding to pings. This forces Nmap to skip the discovery phase entirely. While it ensures you don't miss a firewalled target, it can also waste a lot of time scanning IP addresses that are genuinely offline.

Conclusion

You have just taken your first step into active network scanning. You've moved from a list of potential targets to a confirmed list of live targets, a fundamental pivot in any security assessment.

Key Takeaways:

• Host Discovery is the process of identifying live devices on a network, and it's the first step in active scanning.
• nmap -sn is the primary command for performing a "ping scan," which discovers live hosts without doing a full port scan. It's fast and efficient.
• Nmap's host discovery is robust, using ARP, ICMP, and TCP probes to maximize the chance of finding a live host, even if some probes are blocked.
• The -Pn flag is essential for situations where a firewall blocks all discovery probes. It tells Nmap to skip discovery and assume the host is online.

Next Lesson Preview:
Now that you have a list of confirmed live hosts, the next question is: "What are they running?" In the next lesson, we will dive into the core of network scanning: performing TCP port scans using Nmap. You'll learn how to use SYN scans (-sS) and Connect scans (-sT) to discover open ports and identify the services listening on them, which is where you will begin to find potential vulnerabilities.