Scanning Networks

Network scanning is where reconnaissance turns into a concrete attack surface: live hosts, open ports, running services, versions, operating systems and exploitable weaknesses.

1. What is Network Scanning?

Network scanning is the process of discovering live hosts, open ports, running services, operating systems, and potential vulnerabilities on a network.

2. Why Do We Scan?

• Discover active hosts
• Identify open ports
• Detect running services
• Determine service versions
• Fingerprint operating systems
• Find security weaknesses
• Build an attack surface map

3. Types of Scanning

Host Discovery

What is Host Discovery?

Host Discovery is the process of identifying which devices (hosts) on a network are alive (online) before performing port scanning or service enumeration.

Instead of scanning every IP address, host discovery helps identify only the active systems, making the scanning process faster and more efficient.

Purpose:

• Identify live hosts
• Reduce scanning time
• Avoid scanning inactive IP addresses
• Map the network

3.1 ICMP Ping Scan

What is it?

An ICMP Ping Scan uses the Internet Control Message Protocol (ICMP) to determine whether a host is reachable.

The scanner sends an ICMP Echo Request (Type 8) to the target. If the host is online, it replies with an ICMP Echo Reply (Type 0).

Process

Scanner                     Target

ICMP Echo Request  ---------->
                     <---------- ICMP Echo Reply

Nmap Command

nmap -sn 192.168.1.10

Advantages

• Fast
• Simple
• Works well on internal networks

Disadvantages

• Many firewalls block ICMP.
• No response doesn't always mean the host is offline.

3.2 ARP Scan

What is it?

An ARP Scan uses the Address Resolution Protocol (ARP) to discover live devices on the local network (LAN).

Instead of sending ICMP packets, it broadcasts an ARP Request asking:

"Who has this IP address?"

The device with that IP responds with its MAC address.

Process

Scanner

Who has 192.168.1.20?
        │
        ▼

Broadcast on LAN

        │
        ▼

192.168.1.20 replies:
"My MAC is 00:11:22:33:44:55"

Nmap Command

sudo nmap -PR 192.168.1.0/24

Advantages

• Extremely accurate on local networks.
• Works even if ICMP is blocked.
• Very fast.

Disadvantages

• Only works on the local subnet (Layer 2).
• Cannot discover hosts across routers.

3.3 TCP Ping

What is it?

A TCP Ping determines whether a host is alive by sending a TCP packet to a specific port.

If the target responds with SYN/ACK or RST, Nmap knows the host is online.

Common TCP Ping Methods

• TCP SYN Ping (-PS)
• TCP ACK Ping (-PA)

TCP SYN Ping Process

Scanner                      Target

SYN  ------------------------>
        <-------------------- SYN/ACK or RST

• SYN/ACK → Port is open, host is alive.
• RST → Port is closed, but host is still alive.

Example Commands

nmap -PS80 192.168.1.10

nmap -PS22,80,443 192.168.1.10

Advantages

• Works when ICMP is blocked.
• Reliable against many firewalls.
• Useful for Internet hosts.

Disadvantages

• May be filtered by firewalls.

3.4 UDP Ping

What is it?

A UDP Ping sends a UDP packet to a target port.

Since UDP has no handshake, Nmap determines whether the host is alive based on the response.

Process

Scanner                     Target

UDP Packet  ---------------->

If port is closed:
<---------------- ICMP Port Unreachable

If port is open:
Usually no response

Nmap Command

nmap -PU53 192.168.1.10

Advantages

• Useful when TCP and ICMP are blocked.
• Can discover hosts running UDP services.

Disadvantages

• Slower than TCP.
• No response doesn't always mean the host is offline.
• ICMP responses may be rate-limited.

Comparison Table

Port Scanning

Purpose: Identify open ports.

Common states:

• Open
• Closed
• Filtered
• Unfiltered
• Open|Filtered
• Closed|Filtered

Service Enumeration

Purpose: Identify the application running on an open port.

Example:

• Apache
• Nginx
• OpenSSH
• MySQL

Version Detection

Purpose: Find the exact software version.

Example:

Apache 2.4.58
OpenSSH 9.6

OS Detection

Purpose: Guess the target operating system.

Methods:

• TCP/IP stack fingerprinting
• TTL analysis
• Window size
• TCP options

Vulnerability Scanning

Purpose: Detect known vulnerabilities.

Tools:

• Nessus
• OpenVAS
• Nmap NSE

4. TCP Three-Way Handshake

Client            Server

SYN  ---------->
      <---------- SYN/ACK
ACK  ---------->

Connection Established

5. Common Port Scan Types

6. Important Nmap Commands

Host Discovery

nmap -sn 192.168.1.0/24

Port Scan

nmap 192.168.1.10

Service Detection

nmap -sV 192.168.1.10

OS Detection

nmap -O 192.168.1.10

Aggressive Scan

nmap -A 192.168.1.10

SYN Scan

sudo nmap -sS 192.168.1.10

UDP Scan

sudo nmap -sU 192.168.1.10

Scan All Ports

nmap -p- 192.168.1.10

Top 100 Ports

nmap --top-ports 100 192.168.1.10

7. Common Nmap Options

8. Common Ports to Remember

9. Scanning Workflow

Identify Target
        ↓
Host Discovery
        ↓
Port Scanning
        ↓
Service Enumeration
        ↓
Version Detection
        ↓
OS Detection
        ↓
Vulnerability Identification
        ↓
Exploitation

Step by step:

1. Identify Target — define scope and authorised IP ranges.
2. Host Discovery — find which hosts are alive.
3. Port Scanning — enumerate open/filtered ports.
4. Service Enumeration — identify the application behind each port.
5. Version Detection — pin down exact software versions.
6. OS Detection — fingerprint the operating system.
7. Vulnerability Identification — map versions to known CVEs.
8. Exploitation — attempt access with validated findings.

Network Scanning – Interview Questions & Answers

1. What is the difference between TCP Connect Scan (-sT) and SYN Scan (-sS)?

TCP Connect Scan (-sT)

• Completes the full TCP three-way handshake (SYN → SYN/ACK → ACK).
• Uses the operating system's networking stack.
• Easier to detect because the connection is fully established.
• Does not require root/administrator privileges.

SYN Scan (-sS)

• Sends a SYN packet and waits for a SYN/ACK response.
• Sends an RST instead of ACK, so the connection is never fully established.
• Faster and stealthier than TCP Connect Scan.
• Requires root/administrator privileges (or raw socket access).

Example

nmap -sT 192.168.1.10
sudo nmap -sS 192.168.1.10

2. Why is SYN Scan called a Half-Open Scan?

A SYN Scan is called a half-open scan because it does not complete the TCP three-way handshake.

Normal Connection:

SYN
SYN/ACK
ACK   ← Connection Established

SYN Scan:

SYN
SYN/ACK
RST   ← Connection Terminated

Since the final ACK is never sent, the TCP connection is only partially opened.

3. What is the purpose of -Pn?

-Pn tells Nmap to skip host discovery and assume the target is online.

Use -Pn when:

• ICMP is blocked by a firewall.
• Ping requests are filtered.
• The host appears down even though it is running.

Example:

nmap -Pn 192.168.1.10

4. Why scan all 65,535 ports?

By default, Nmap scans only the top 1,000 most common ports.

Scanning all ports (-p-) helps find:

• Services running on uncommon ports.
• Hidden administrative interfaces.
• Backdoors or custom applications.
• Misconfigured services.

Example:

nmap -p- 192.168.1.10

5. What is the difference between Open and Filtered ports?

Open Port

• An application is actively listening.
• The scanner receives a valid response.
• The service is accessible.

Example:

22/tcp open ssh

Filtered Port

• A firewall or packet filter blocks the probe.
• Nmap cannot determine whether the port is open or closed.

Example:

22/tcp filtered ssh

Key Difference

• Open: The service responds.
• Filtered: A firewall prevents Nmap from determining the port state.

6. Why are UDP scans slower than TCP scans?

UDP is connectionless, so there is no handshake.

Reasons UDP scans are slower:

• No SYN/SYN-ACK exchange to quickly determine state.
• Open UDP services often do not respond at all.
• Nmap waits for timeouts when no reply is received.
• ICMP "Port Unreachable" messages may be rate-limited.

As a result, Nmap must wait longer before deciding a UDP port is open, closed, or open|filtered.

7. What is Banner Grabbing?

Banner grabbing is the process of collecting information that a service reveals when you connect to it.

It may disclose:

• Software name
• Version number
• Operating system
• Service details

Example:

SSH-2.0-OpenSSH_9.6

This helps identify the software and assess whether known vulnerabilities may apply.

8. What information does -sV provide?

-sV enables service version detection.

It identifies:

• Service name
• Version number
• Product information
• Sometimes protocol details

Example:

nmap -sV 192.168.1.10

Output:

22/tcp open ssh OpenSSH 9.6
80/tcp open http Apache httpd 2.4.58

9. How does Nmap detect an Operating System?

Nmap performs TCP/IP stack fingerprinting.

It analyzes characteristics such as:

• TCP window size
• TTL (Time To Live)
• TCP flags
• IP ID sequence
• TCP options
• Responses to specially crafted packets

These responses are compared against Nmap's fingerprint database to estimate the operating system.

Command:

sudo nmap -O 192.168.1.10

10. What is the difference between Enumeration and Scanning?

Scanning

Scanning is the process of identifying systems and exposed services.

Examples:

• Discover live hosts
• Find open ports
• Detect services
• Identify operating systems

Enumeration

Enumeration is the process of extracting detailed information from identified services.

Examples:

• SMB users and shares
• SNMP community strings
• DNS zone information
• LDAP directory data
• FTP anonymous access

Comparison

Quick Revision

Most Used Network Scanning Tools