HTB Academy - Host Discovery nmap

Nmap Cribs – Common Host Discovery Scans

🎯 Objective

Fast, reliable host discovery during recon. These are my go‑to nmap one‑liners for ranges, lists, ad‑hoc targets, and when I need to force/inspect ICMP vs ARP behavior.

🧩 What I’m exploiting

• ARP ping (-sn on local/L2 networks) is the quickest way to confirm hosts on the same segment.
• ICMP Echo (-PE) helps when ARP isn’t available (e.g., routed/L3).
• Packet trace / reason flags clarify why nmap considers a host up (ARP reply, echo reply, etc.).

🧭 Steps / Recipes

Scan Network Range and Only Display Active Hosts

XsiSec@htb[/htb]$ sudo nmap 10.129.2.0/24 -sn -oA tnet | grep for | cut -d" " -f5
10.129.2.4
10.129.2.10
10.129.2.11
10.129.2.18
10.129.2.19
10.129.2.20
10.129.2.28

Scan IP List

During internal tests, I’m often given a host list.

Example host list:

XsiSec@htb[/htb]$ cat hosts.lst
10.129.2.4
10.129.2.10
10.129.2.11
10.129.2.18
10.129.2.19
10.129.2.20
10.129.2.28

Scan the list:

XsiSec@htb[/htb]$ sudo nmap -sn -oA tnet -iL hosts.lst | grep for | cut -d" " -f5
10.129.2.18
10.129.2.19
10.129.2.20

Used Options

• -sn → disables port scanning (ping sweep only)
• -oA tnet → outputs all formats with prefix tnet
• -iL hosts.lst → scan from list

Scan Multiple IPs (and Ranges)

XsiSec@htb[/htb]$ sudo nmap -sn -oA tnet 10.129.2.18 10.129.2.19 10.129.2.20 | grep for | cut -d" " -f5
10.129.2.18
10.129.2.19
10.129.2.20

Or a concise IP range:

XsiSec@htb[/htb]$ sudo nmap -sn -oA tnet 10.129.2.18-20 | grep for | cut -d" " -f5
10.129.2.18
10.129.2.19
10.129.2.20

Scan a Single Host (confirm liveness before port scan)

XsiSec@htb[/htb]$ sudo nmap 10.129.2.18 -sn -oA host
Starting Nmap 7.80 ( https://nmap.org ) at 2020-06-14 23:59 CEST
Nmap scan report for 10.129.2.18
Host is up (0.087s latency).
MAC Address: DE:AD:00:00:BE:EF
Nmap done: 1 IP address (1 host up) scanned in 0.11 seconds

Used Options

• Target → 10.129.2.18
• -sn → disables port scanning
• -oA host → outputs all formats with prefix host

Forcing ICMP Echo Requests

By default with -sn, nmap does ARP first on local nets, then ICMP. Force ICMP with -PE and inspect with --packet-trace:

XsiSec@htb[/htb]$ sudo nmap 10.129.2.18 -sn -oA host -PE --packet-trace

Sample Output:

SENT (0.0074s) ARP who-has 10.129.2.18 tell 10.10.14.2
RCVD (0.0309s) ARP reply 10.129.2.18 is-at DE:AD:00:00:BE:EF
Host is up (0.023s latency).
MAC Address: DE:AD:00:00:BE:EF

Used Options

• -PE → send ICMP Echo Requests
• --packet-trace → show packets sent/received

Display Reason for Host Status

XsiSec@htb[/htb]$ sudo nmap 10.129.2.18 -sn -oA host -PE --reason

Output highlights the reason (e.g., ARP reply, echo reply) nmap considers the host up.

Disabling ARP Pings

Force only ICMP by disabling ARP:

XsiSec@htb[/htb]$ sudo nmap 10.129.2.18 -sn -oA host -PE --packet-trace --disable-arp-ping

You’ll see explicit ICMP echo request and echo reply in the trace.

📎 Copy‑paste crib list

# Range ping sweep (alive only)
sudo nmap 10.129.2.0/24 -sn -oA tnet

# From list
sudo nmap -sn -oA tnet -iL hosts.lst

# Ad-hoc IPs or range
sudo nmap -sn -oA tnet 10.129.2.18 10.129.2.19 10.129.2.20
sudo nmap -sn -oA tnet 10.129.2.18-20

# Single host liveness
sudo nmap 10.129.2.18 -sn -oA host

# ICMP echo focus + packet trace
sudo nmap 10.129.2.18 -sn -oA host -PE --packet-trace

# Show reason for up/down
sudo nmap 10.129.2.18 -sn -PE --reason

# Disable ARP (ICMP only)
sudo nmap 10.129.2.18 -sn -PE --packet-trace --disable-arp-ping

🧪 Troubleshooting

• No hosts detected? Networks may block ICMP. Try ARP (-PR, default on local net) or TCP/ACK/ports (-PS, -PA) with -Pn for later scans.
• Need privileges? Use sudo so nmap can craft raw packets; otherwise it may fall back and miss hosts.
• Firewalls/NAT quirks: Expect asymmetric results across subnets; try ICMP and ARP depending on where you sit.
• Rate/volume: On large ranges, throttle or batch to avoid IDS triggers; consider --min-rate judiciously.

🔒 Defense (notes to self)

• Monitor for unusual ping sweeps (high‑rate ICMP/ARP).
• Rate‑limit ICMP, segment L2 domains, and disable L2 broadcasting where possible.
• Prefer authenticated discovery tooling internally to reduce noisy scans in production windows.

✅ Result

A compact crib sheet I use for host discovery with nmap—covering ranges, lists, one‑offs, and packet‑level verification (ARP vs ICMP). Ready to paste into runbooks.