Discovering hosts with TCP SYN ping scans

Ping scans are used for detecting live hosts in networks. Nmap's default ping scan (-sP) uses a TCP ACK and an ICMP echo request to determine if a host is responding, but if a firewall is blocking these requests, we will miss this host. Fortunately, Nmap supports a scanning technique called the TCP SYN ping scan that is very handy in these situations, where system administrators could have been more flexible with other firewall rules.

This recipe will talk about the TCP SYN ping scan and its related options.

How to do it...

Open your terminal and enter the following command:

$ nmap -sP -PS 192.168.1.1/24

You should see the list of hosts found using the TCP SYN ping scan:

$ nmap -sP -PS 192.168.1.1/24 
Nmap scan report for 192.168.1.101 
Host is up (0.088s latency). 
Nmap scan report for 192.168.1.102 
Host is up (0.000085s latency). 
Nmap scan report for 192.168.1.254 
Host is up (0.0042s latency). 
Nmap done: 256 IP addresses (3 hosts up) scanned...