Using port scanning for host discovery

While port scanning is one of the later phases during a scan, you can only rely on it to determine whether a host is online. For example, if we are scanning a range with only web servers, it can make sense to find hosts running that service using only port scanning. Under the hood, this achieves the same result as an SYN ping scan sent to specific ports.

In this recipe, you will learn how to use only port scanning to determine whether a host is online.

How to do it...

Open your terminal and enter the following command for hosts with port 80 open:

# nmap -Pn -p80 -n <target>

If the service is open, Nmap will mark the host as online. You can use the --packet-trace option to see how host discovery is skipped and only the port discovery process happens:

% nmap -Pn -n -p80 --packet-trace scanme.nmap.org
CONN (0.0357s) TCP localhost > 45.33.32.156:80 => Operation now in progress
CONN (0.1341s) TCP localhost > 45.33.32...