16

The nmap man page has this to say about the -sn parameter:

-sn (No port scan) . This option tells Nmap not to do a port scan after host discovery, and only print out the available hosts that responded to the scan.

The first half of the sentence mentions that there is no scan, but the second half says that there is a scan. Is there a different type of scan than a port scan that the second half is referring to? A host-discovery scan perhaps (guessing from the little that I know about nmap)?

Improve this question

3 Answers 3

Reset to default
16

You're right that the documentation is worded poorly. -sn means "skip the port scan phase," and was previously available as -sP, with the mnemonic "Ping scan".

Nmap scans happen in phases. These are:

  1. Name resolution
  2. NSE script pre-scan phase
  3. Host discovery ("ping" scan, but not necessarily ICMP Echo request)
  4. Parallel reverse name resolution
  5. Port or Protocol scan
  6. Service version detection
  7. OS fingerprinting
  8. Traceroute
  9. NSE portrule and hostrule script scanning phase
  10. NSE post-scan phase

Note that not all these phases get executed in every scan, depending on the arguments. This scan:

nmap -sn scanme.nmap.org

will run phases 1, 3, and 4.

EDIT: I corrected the documentation you referred to in r33790:

This option tells Nmap not to do a port scan after host discovery, and only print out the available hosts that responded to the host discovery probes.

Improve this answer
6

In its standard mode, nmap does two different types of scan: a host scan, to determine which hosts are available for further port scanning, and a port scan, which reveals the status of ports on available machines. -sn does no port scan, but it does a host scan -- this is particularly useful when scanning a range with nmap, where it will print out those hosts that responded to the scan (which could, for example, reveal some of the hosts available on a certain subnet).

For example:

$ nmap -sn 192.168.0.0/24 Starting Nmap 6.40 ( http://nmap.org ) at 2013-08-23 17:54 CEST Nmap scan report for 192.168.0.11 Host is up (0.051s latency). Nmap scan report for 192.168.0.37 Host is up (0.063s latency). Nmap scan report for 192.168.0.65 Host is up (0.016s latency). Nmap scan report for 192.168.0.85 Host is up (0.00090s latency). Nmap scan report for 192.168.0.149 Host is up (0.024s latency). Nmap scan report for 192.168.0.202 Host is up (0.021s latency). Nmap scan report for 192.168.0.253 Host is up (0.042s latency). Nmap done: 256 IP addresses (7 hosts up) scanned in 22.26 seconds
Improve this answer
2

Yes, -sn is a ping scan for host discovery, and does not do any detailed port scan (which ports are open on the host). These are 2 different scans that the man page is talking about. Your interpretation is pretty close.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.