Host Discovery Techniques in Ethical Hacking: ICMP, ARP, TCP and UDP Scans Explained

Key takeaways

• On a local LAN, ARP discovery (-PR) is the most reliable.
• Use different probes when a firewall blocks ICMP; no single probe always works.
• -sn does discovery only; -Pn skips it and treats every host as up.
• Scan only with written authorisation; practise on lab VMs.

What is host discovery?

Host discovery is the first stage of a network scan. It answers one question: which IP addresses in this range have a live device behind them? Only those hosts are worth port scanning, so doing it well saves time and reduces noise on the network.

Nmap sends one or more probes to each address and treats any reply as proof the host is up. Different probes work in different situations because firewalls block different things. Run these only on networks you own or have written permission to test; scanning others without authorisation can break the IT Act. Practise on a lab network, such as VMs on a host-only adapter with Metasploitable or your own machines.

The main techniques and the Nmap options

The option -sn means "host discovery only, no port scan". It replaced the older -sP. Add -n to skip DNS lookups and speed things up.

What does Nmap do by default?

If you run nmap -sn with root privileges on a local Ethernet segment, Nmap uses ARP. For addresses on other networks it uses an ICMP echo request, a TCP SYN to port 443, a TCP ACK to port 80 and an ICMP timestamp request. Without root it falls back to TCP connect pings. Defaults are documented in the Nmap reference guide, so check the version you use.

Worked example on a lab network

Assume a host-only network 192.168.56.0/24 with a Kali VM and a Metasploitable VM. These are examples of the shape of the output, not captured from a specific lab.

sudo nmap -sn 192.168.56.0/24

Nmap scan report for 192.168.56.101
Host is up (0.00040s latency).
MAC Address: 08:00:27:xx:xx:xx (PCS Systemtechnik/Oracle VirtualBox)
Nmap scan report for 192.168.56.103
Host is up.
Nmap done: 256 IP addresses (2 hosts up) scanned in 2.1 seconds

The MAC address line appears only for hosts on the same segment, which tells you ARP was used. Now force a different probe and compare:

sudo nmap -sn -PE 192.168.56.0/24 # ICMP echo only
sudo nmap -sn -PS80,443 192.168.56.101 # TCP SYN to ports 80 and 443
sudo nmap -sn -PR -n 192.168.56.0/24 # ARP only, no DNS

Add --packet-trace to see exactly which packets Nmap sends and receives. Open Wireshark on the same interface to watch ARP, ICMP and TCP flags with your own eyes. That comparison is the fastest way to understand why each technique behaves differently.

When a host looks down but is not

A firewall that drops your probes makes a live host appear dead. If you know a host exists and discovery says it is down, try a different probe, or skip discovery with -Pn and scan its ports directly. Be aware that -Pn on a large range is slow, because Nmap treats every address as up.

Some claims you may read, such as "timestamp ping always bypasses firewalls", are overstated. Which probe gets through depends entirely on the rules in place. Test, do not assume.

Ping sweep tools with a graphical interface

Angry IP Scanner, Advanced IP Scanner and similar tools run ping sweeps and list live hosts. They are convenient for quick inventory work on your own network. Nmap gives more control over probe types and is scriptable.

Detection and defence

• Sweeps create a burst of ICMP echo, ARP requests or SYN packets to many consecutive addresses. IDS tools such as Snort or Suricata and many firewalls can alert on this.
• Rate-limit ICMP at network edges, and allow only the ICMP types you need.
• Do not rely on hiding from ping. Hosts that must be reachable will answer something, so focus on patching and closing services.
• On switches, features such as dynamic ARP inspection help against ARP-based abuse.

What are the common mistakes?

• Scanning without written authorisation.
• Running without root and assuming ARP was used.
• Concluding a host is offline after a single probe type.
• Forgetting -n and waiting on slow DNS lookups.

For the full reference, see the Nmap host discovery techniques chapter and the broader Nmap reference guide.

Next steps

To practise scanning in a structured way, see the VAPT course. For the graphical version of this topic read host discovery in Zenmap, and for the wider picture what network scanning is.

Related reading

• Host Discovery Techniques in Ethical Hacking | ARP, ICMP, TCP, UDP, and IP Protocol Scans Explained with Nmap Commands and Real-Time Use Cases