Host Discovery

Recon-methodology put the steps in order: passive OSINT first, then host discovery, then the port scan, each rung narrowing the next. Host discovery is rung two, and it is the first one that sends anything at the target. Everything before it was quiet. This is the step a defender can start to see.

The scope reads 10.10.14.0/24. That is a CIDR block of 256 addresses, and on most networks the large majority of them are empty air. Throwing a full port scan at all 256 wastes minutes and makes noise against addresses where nothing lives. Host discovery turns 256 maybes into the short list of machines that actually answer, so every later scan runs against real hosts instead of the void.

The quietest look: list the range

Before sending a single probe, nmap can expand the range on paper. nmap -sL takes the CIDR block, works out every address it covers, does a reverse DNS lookup on each one, and prints the result. No packet reaches the targets themselves; only a DNS resolver gets asked. It is the closest thing to passive recon that nmap offers, and the names it prints often leak structure for free. A mail01 or a dc01 sitting in the list names what a box is before anything touches it.

$nmap -sL 10.10.14.0/24

Run it first when quiet matters. The output narrows where to aim once the real probing starts.

Ask every address if it is home

The oldest form of host discovery is a ping sweep. The ping tool sends an ICMP echo request to an IP address and waits for an echo reply. A reply means something is there and willing to answer. Do that for every address in the range, note the ones that respond, and that list is the set of live hosts.

Written as a shell loop, one address at a time:

$for i in $(seq 1 254); do ping -c 1 -W 1 10.10.14.$i >/dev/null 2>&1 && echo 10.10.14.$i up; done

That works, and it needs nothing but a shell. It is also slow. Each ping waits out its full timeout before the loop moves to the next address, so sweeping a quiet range crawls while it sits through 250 non-answers one after another. And it asks exactly one question, ICMP echo, which plenty of hosts are set up never to answer.

nmap -sn, the real first move

nmap does the same sweep in parallel and asks more than one question. The -sn flag means no port scan: nmap runs host discovery and stops before it touches a single port. Against a whole range, this is the standard first active step.

$nmap -sn 10.10.14.0/24

Three live hosts out of 256. That is the real target list, and every later scan in this module runs against those three, not the whole block. The latency figure on each line is the round-trip time nmap measured to that host, useful as a rough sense of how close it sits. The last line sums the run up: 256 addresses probed, three up, in 2.34 seconds. The shell loop would still be grinding through timeouts.

-sn is not a bare ping, and that is the point. Run with privileges against a network past the local segment, nmap sends four probes to each address at once: an ICMP echo request, a TCP SYN to port 443, a TCP ACK to port 80, and an ICMP timestamp request. One reply from any of them marks the host up. A machine that drops ICMP but answers on 443 still gets found, which is exactly the case a bare ping sweep misses.

Those raw probes need privileges. Without root, nmap falls back to a plain TCP connection attempt on ports 80 and 443, which is slower and easier to filter. Run host discovery with sudo when the machine allows it.

A quiet address is not an empty one

The trap in host discovery is reading silence as absence. A firewall can drop the probe before the host ever sees it, and the scan looks identical to scanning dead air. Windows is the standard example: a default Windows install drops inbound ICMP echo, so a plain ping sweep of a subnet full of Windows machines can report almost nothing while every one of them is up and running.

So "it did not answer" splits into two very different facts. Either the host is gone, or the host is filtering the exact question that got asked. Telling those apart is the whole skill, and the way to do it is to ask a different question.

On the local segment, ARP does not miss

There is one network where silence cannot hide a host: the one the scanner is plugged into. Every machine on a local segment uses ARP to map an IP address to the MAC address of a network card, and it has to answer ARP to send or receive anything at all. A host can drop every ICMP packet thrown at it and still be forced to answer ARP, because a host that refuses ARP has effectively fallen off the network.

$sudo arp-scan --localnet

nmap knows this too. Run sudo nmap -sn against the local range and it quietly drops the ICMP and TCP probes and uses ARP instead, because on the segment ARP is both faster and impossible to filter. The MAC address in each line is a bonus: the first half of the address names the network card's vendor, and a segment full of VMware and VirtualBox addresses is itself a clue that the hosts are virtual machines rather than physical hardware.

When ICMP is filtered, change the question

Off the local segment, against a host that ignores ICMP, the move is to knock with the protocols that real services speak. nmap calls these ping types, and each -P flag is a different question aimed at the same address.

A TCP SYN ping (-PS) sends a SYN, the opening packet of the three-way handshake, to the ports listed after the flag. A listening service answers, and even a closed port usually answers with a reset, which still proves the host is alive.

$sudo nmap -sn -PS22,80,443 10.10.14.0/24

A TCP ACK ping (-PA80) sends a bare ACK instead. Some stateless filters that let ICMP through and block SYNs will still pass an ACK, so it catches hosts the SYN ping did not. A UDP ping (-PU) sends a UDP packet to a port, and a closed UDP port replies with an ICMP port-unreachable message, which is itself a sign of life.

$sudo nmap -sn -PU53,161 10.10.14.0/24

nmap also carries two ICMP questions beyond echo: a timestamp request (-PP) and an address-mask request (-PM). A host tuned to drop echo sometimes still answers one of those, so firing all three ICMP types together covers more ground than echo alone.

$sudo nmap -sn -PE -PP -PM 10.10.14.0/24

When discovery keeps coming back empty but a host is known to be there, -Pn tells nmap to skip host discovery entirely, treat the address as up, and scan it anyway.

$nmap -Pn 10.10.14.5

-Pn is the correct call against a single host already confirmed to exist by other means. It is the wrong call across a whole /24, where it turns a two-second sweep into 256 full port scans, most of them aimed at empty air.

Every extra probe type is another packet in a defender's log. recon-methodology framed noise as a cost, and it lands here directly: firing ICMP, TCP SYN, TCP ACK, and UDP probes at once finds the most hosts and trips the most alerts. On a loud internal test that trade is fine. When staying quiet matters, one or two probe types is the place to start, with the rest held back until the quiet ones come back empty.

Host discovery ends with a list and nothing more: the addresses that proved they are alive. It says nothing about what they run or which ports stand open. That is the next rung. port-scanning-deep-dive takes the short list this step produced and probes the ports on each live host, turning "these machines exist" into "here is what each one is running."