Nmap for Pentester: Host Discovery Guide

12 hours ago
5 min read

"Knock, knock. Who's there? A TCP SYN packet."

Nmap host discovery scan visualized on a dark network operations dashboard

Introduction

Host discovery is the first step in network penetration testing: you need to know which hosts are alive before port scanning or exploitation. Nmap offers several discovery techniques so you can adapt when the target blocks standard ICMP ping or uses a firewall.

This guide explains what each command does and why you need it during a pentest, with commands you can run in a lab and terminal screenshots from real scans. After you have a live host list, continue with our FTP/SSH enumeration and PenTesting cheatsheet for the next phases.

What is Nmap?

From the Official Nmap documentation:

Nmap ("Network Mapper") is a free and open source utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime.

Default host discovery behavior

Before you override anything, know what Nmap already does. By default (especially when running as a privileged user), Nmap combines multiple discovery probes, typically including ICMP echo, TCP SYN (often toward port 443), TCP ACK (often toward port 80), and ICMP timestamp requests, depending on platform and privileges. If one method is filtered, another may still mark the host as up. Unprivileged scans use a slightly different mix (e.g. connect()-style probes to common ports).

Note: Several techniques in this guide (especially -Pn) increase probe volume and can trigger IDS/IPS or firewall alerts. Use only within defined scope and with client approval where required.

Ping sweep (no port scan)

What it does: -sn tells Nmap to discover hosts only, no port scan. (Older Nmap versions used -sP; prefer -sn on current releases.) On a local subnet Nmap typically uses ARP for discovery; hosts that reply are marked up. Nmap does not probe TCP/UDP ports in this mode, so the scan is fast and avoids port-based IDS rules.

Why you need it on a pentest: Identify live IPs before spending time on -sV or script scans. In internal tests, ARP-based -sn is very fast on the LAN.

nmap -sn 10.11.12.0/24

To see what Nmap sends without Wireshark:

nmap -sn 10.11.12.0/24 --packet-trace

Traceroute

What it does: --traceroute discovers the hop list to the target using TTL: probes with increasing TTL record routers that respond with Time Exceeded.

Why you need it on a pentest: Traceroute reveals the network path (hop list), not full topology. It helps document segmentation, border devices, and where probes drop. Combine with -sn for discovery and path mapping in one run.

nmap -sn --traceroute 10.11.12.1

Disable ARP ping and send-eth

What it does: On the same LAN, Nmap uses ARP by default. These options differ:

--disable-arp-ping turns off ARP so Nmap falls back to IP-layer probes (ICMP, TCP, etc.).
--send-eth forces raw Ethernet frames for host discovery (often useful on Windows with Npcap).

The host is considered up only if it responds to the probes Nmap actually sends.

Why you need it on a pentest: Disabling ARP makes discovery behave more like a cross-subnet scan and helps test firewall/IDS rules. ICMP/TCP/UDP examples below use --disable-arp-ping to show IP-based discovery; on a pure LAN sweep, omit it and let -sn use ARP.

nmap -sn 10.11.12.10 --disable-arp-ping

nmap -sn 10.11.12.10 --packet-trace --send-eth

TCP SYN ping scan (-PS)

What it does: Nmap sends TCP SYN to one or more ports (default includes 80). Closed ports typically reply RST; open ports SYN/ACK. Either response marks the host up. No full handshake is completed.

Why you need it on a pentest: Many networks block ICMP but allow TCP to web ports. -PS is a first fallback when default -sn finds nothing. Use -PS80,443 (or other in-scope ports) for filtered environments.

nmap -sn -PS 10.11.12.10 --disable-arp-ping
nmap -sn -PS22,3389 10.11.12.10 --disable-arp-ping

TCP ACK ping scan (-PA)

What it does: Nmap sends TCP ACK with no prior SYN. The target should respond RST, which is enough to mark the host up.

Why you need it on a pentest: Some ACLs block inbound SYN but still return RST to ACK probes. Use -PA when -PS fails but the host may still be live.

nmap -sn -PA 10.11.12.10 --disable-arp-ping

ICMP echo ping scan (-PE)

What it does: ICMP Echo Request (Type 8); the host replies with Echo Reply (Type 0) when permitted.

Why you need it on a pentest: Simple discovery when ICMP is allowed. Document whether ICMP is blocked in the client report; switch to -PS, -PA, or -PU when echo is filtered.

nmap -sn -PE 10.11.12.10 --disable-arp-ping
nmap -sn -PE 10.11.12.1-10

ICMP address mask and timestamp (-PM, -PP)

What it does: -PM sends ICMP Address Mask Request (Type 17); -PP sends ICMP Timestamp Request (Type 13). A reply indicates the host is up.

Why you need it on a pentest: Some networks block Echo but leave other ICMP types open. Try -PM or -PP when -PE fails to document partial ICMP filtering.

nmap -sn -PM 10.11.12.10 --disable-arp-ping
nmap -sn -PP 10.11.12.10 --disable-arp-ping

UDP ping scan (-PU)

What it does: Nmap sends UDP to a port (default 40125, or specify one). ICMP Port Unreachable or an application reply can mark the host up. No UDP response does not prove the host is down; many stacks silently drop unsolicited UDP.

Why you need it on a pentest: Use when TCP and ICMP fail. Target known UDP services (e.g. -PU53 for DNS) to increase response chance.

nmap -sn -PU 10.11.12.10 --disable-arp-ping

IP protocol ping (-PO)

What it does: Nmap sends raw IP packets with specific protocol numbers. ICMP Protocol Unreachable or similar responses can mark the host up.

Why you need it on a pentest: Last-resort discovery when common probes are filtered but the IP stack still responds at the protocol layer.

nmap -sn -PO 10.11.12.10 --disable-arp-ping

No ping (-Pn)

What it does: Skips host discovery; every specified IP is treated as up and port scanning runs immediately.

Why you need it on a pentest: Use on a tight IP list when all discovery methods fail. Expect slower scans, more traffic, and higher IDS noise than light discovery.

nmap -Pn 10.12.11.10

ARP ping scan (-PR)

What it does: ARP requests on the same Layer 2 segment; ARP replies mark hosts up. Bypasses IP-based firewall rules.

Why you need it on a pentest: Fastest internal LAN discovery. ARP works only on the local L2 segment, not across routers.

nmap -sn -PR 10.11.12.10

SCTP INIT ping (-PY)

What it does: Sends an SCTP INIT chunk (often to port 80). INIT-ACK or abort can infer the host is up.

Why you need it on a pentest: Rare in typical enterprise LANs; useful in telecom or carrier environments where SCTP is in use.

nmap -sn -PY 10.11.12.10 --disable-arp-ping

When to use which technique

Situation	Prefer
LAN / same L2 segment	-sn (ARP by default) or -PR for explicit ARP-only discovery
ICMP echo blocked	-PS / -PA toward allowed ports (e.g. -PS80,443)
Strict firewall, TCP heavily filtered	-PU, then -PO
Discovery fails but targets may still be up	-Pn on a tight IP list (noisy; plan with client)

Default Nmap already combines several probes; add explicit flags when you need to bypass specific blocks or document how the network responds.

Quick References

Goal	Nmap option
Ping sweep (no ports)	-sn (not deprecated -sP)
No ARP (IP probes only)	--disable-arp-ping
Raw Ethernet discovery	--send-eth
TCP SYN ping	-PS or -PS80,443
TCP ACK ping	-PA
ICMP Echo	-PE
ICMP Timestamp	-PP
ICMP Address Mask	-PM
UDP ping	-PU
IP protocol ping	-PO
Skip discovery	-Pn
ARP ping	-PR
SCTP INIT	-PY
Traceroute	--traceroute

Conclusion

Host discovery sets the target list for every later phase. On internal LANs, -sn with ARP is usually enough; across filtered perimeters, rotate through -PS, -PA, -PU, and -PO before resorting to -Pn on a scoped IP list. Document which probes worked: that evidence belongs in the report firewall and segmentation section.

References

Check out our self-paced learning paths! https://www.darkrelay.com/learning-paths

Explore our bundled Pricing & Plans for cost-effective options! Buy a course subscription to learn more—hands-on labs and expert-led training included. https://www.darkrelay.com/plans-pricing

Offensive Security

Security Engineering

Apps, APIs & Infrastructure Testing

Real-world Adversary Simulations

Vulnerability Research & Exploit

Protect Embedded Devices

Early Stage Security Integration

Mitigate Supply Chain Risks

Secure Life-critical Systems

Secure AI systems and Defend with AI

Why DarkRelay?

Certified Experts GIAC (SANS), CISSP & OSCP-certified experts