Nmap network enumeration

Before scanning ports, it is often useful to determine which hosts are reachable. Nmap can perform host discovery without starting a full port scan. The behaviour changes depending on whether the target is on the local network or across routed networks.

A host may be online but not respond to the discovery probes Nmap normally uses. The -Pn option tells Nmap to treat the target as online and continue directly with the port scan. This is useful when ICMP or other discovery traffic is filtered.

When troubleshooting a scan, --reason explains why Nmap considers a host or port to be in a particular state. --packet-trace goes further by displaying packets sent and received during the scan.

On a local Ethernet network, Nmap can use ARP for host discovery. ARP is generally very reliable because devices on the same Layer 2 segment must answer ARP requests to communicate. The --disable-arp-ping option disables this behaviour when you specifically want to test another discovery method.

The port selection has a major impact on scan time. A quick scan can focus on common ports, while a complete enumeration should eventually cover the full TCP port range.

The SYN scan is one of the most commonly used TCP scan types. Nmap sends a SYN packet and evaluates the response without completing a normal TCP connection. It is commonly used for efficient TCP port discovery.

An ACK scan is mainly useful for understanding firewall filtering behaviour rather than determining whether a service is listening. It can help distinguish between filtered and unfiltered ports depending on how the target network handles ACK packets.

UDP enumeration is different from TCP because many UDP services do not respond when a probe is sent. This can make UDP scans slower and results may appear as open|filtered when Nmap cannot determine the exact state.

Finding an open port is only the beginning. The -sV option probes discovered services to identify the application, protocol and possible version running behind each port.

The Nmap Scripting Engine (NSE) extends Nmap with scripts for discovery, enumeration and protocol-specific checks. -sC runs the default script category, while --script allows a specific script or group of scripts to be selected.

Nmap can estimate the operating system by comparing network responses against its fingerprint database. OS detection is more reliable when Nmap can observe both open and closed ports.

The -A option enables several enumeration features at once, including OS detection, service/version detection, default NSE scripts and traceroute. It provides a lot of information but also generates more traffic than a focused scan.

Saving results is important when scans are part of a larger enumeration process. Nmap supports normal text, XML, grepable output and -oA, which creates several output formats from a single scan.

Long scans can take time. Verbose mode provides additional information while the scan runs, and --stats-every can periodically display scan progress.

Nmap timing templates range from T0 to T5. Lower values are slower and more conservative, while higher values make the scan more aggressive. Faster is not always better because packet loss, latency or rate limiting can reduce scan accuracy.

Performance can also be adjusted directly. --max-retries limits how often Nmap retransmits probes, while --min-rate requests a minimum packet sending rate. These options can reduce scan time but aggressive values may cause ports to be missed on unstable networks.

Round-trip timeout values determine how long Nmap waits for responses. Reducing these values can improve performance on fast and predictable networks, but values that are too aggressive may cause valid responses to be missed.

Nmap can be instructed to use a specific network interface, source address or source port. These options are mainly useful when working with multiple interfaces, routing scenarios or controlled network testing.

Nmap can perform DNS resolution through a specified DNS server instead of relying only on the system resolver.

A useful workflow is to start with discovery, identify open ports, and only then perform deeper enumeration against the services that were actually discovered. This keeps scans organised and avoids running every option at once.