Host Discovery Methods

Before you can map a network or assess its security, you need to know which devices are actually online and reachable. This process is called host discovery. Identifying live hosts is a critical first step in network enumeration, as it helps you focus your attention and resources on systems that are present, instead of wasting time scanning inactive or non-existent devices.

Several methods exist for discovering hosts on a network, each leveraging different protocols and techniques. The most common approaches include:

• ICMP Echo Requests: Often referred to as "ping," this method sends ICMP echo requests to target hosts. If a host is alive and not blocking ICMP, it will respond with an echo reply. However, many firewalls and network devices block ICMP to prevent such discovery;
• ARP Requests: On local networks, Address Resolution Protocol (ARP) requests are used to map IP addresses to MAC addresses. By sending ARP requests, you can identify all live hosts on the same subnet, even if they block ICMP;
• TCP Ping Scans: Instead of relying on ICMP, TCP ping scans send TCP packets (often SYN or ACK) to common ports (like 80 or 443). If a host responds, it is likely alive. This method can bypass some ICMP-based restrictions and identify hosts that might otherwise remain hidden.

Understanding these techniques allows you to select the right tool for the job, depending on the network environment and security controls in place.

# To perform a basic host discovery (ping scan) with Nmap, use:
# nmap -sn 192.168.1.0/24

# This command will send ICMP echo requests, ARP requests (on local networks),
# and TCP probes to identify which hosts are up in the 192.168.1.0/24 subnet.

The -sn option in Nmap tells the tool to skip port scanning and perform only host discovery. This is often called a ping scan, as it focuses solely on determining which hosts are up in the specified subnet. By using nmap -sn 192.168.1.0/24, you quickly get a list of live devices without probing their ports or services, making it an efficient way to map out the basic network topology.