2

Here as man page says, "-sn: Ping Scan - disable port scan", and "-sL: List Scan - simply list targets to scan"

I Tried this:

    ➜  ~ sudo nmap -sn scanme.nmap.org 
    Starting Nmap 7.70 ( https://nmap.org ) at 2018-06-24 17:35 CST
    Cannot find nmap-payloads. UDP payloads are disabled.
    Nmap scan report for scanme.nmap.org (45.33.32.156)
    Host is up (0.20s latency).
    Nmap done: 1 IP address (1 host up) scanned in 0.22 seconds

    ➜  ~ sudo nmap -sL scanme.nmap.org
    Starting Nmap 7.70 ( https://nmap.org ) at 2018-06-24 17:36 CST
    Nmap scan report for scanme.nmap.org (45.33.32.156)
    Nmap done: 1 IP address (0 hosts up) scanned in 0.02 seconds

Question: why using -sn can find one active host, but using -sL can't?

3

When using just -sL, no packets are sent to the target host (nmap can therefore not say whether the host is up or not), it just performs a host name lookup.

From the manual:

-sL (List Scan)

The list scan is a degenerate form of host discovery that simply lists each host of the network(s) specified, without sending any packets to the target hosts. By default, Nmap still does reverse-DNS resolution on the hosts to learn their names. It is often surprising how much useful information simple hostnames give out. For example, fw.chi is the name of one company's Chicago firewall.

Nmap also reports the total number of IP addresses at the end. The list scan is a good sanity check to ensure that you have proper IP addresses for your targets. If the hosts sport domain names you do not recognize, it is worth investigating further to prevent scanning the wrong company's network.

Since the idea is to simply print a list of target hosts, options for higher level functionality such as port scanning, OS detection, or ping scanning cannot be combined with this. If you wish to disable ping scanning while still performing such higher level functionality, read up on the -Pn (skip ping) option.

0

If you capture all packets on the network (maybe with wireshark (install from your distro repository)) and execute both nmap -sn and nmap -sLyou will notice that the former resolves each IP number (in order) in the range given using ARP (level 2) resolutions and the latter will perform DNS searches.

There is also a longer description also in the manual (man nmap):

-sn (No port scan)
This option tells Nmap not to do a port scan after host discovery, and only print out the available hosts that responded to the host discovery probes. This is often known as a "ping scan", but you can also request that traceroute and NSE host scripts be run. This is by default one step more intrusive than the list scan, and can often be used for the same purposes.

-sL (List Scan)
The list scan is a degenerate form of host discovery that simply lists each host of the network(s) specified, without sending any packets to the target hosts.

Not "sending any packets to the target" means "at layer 3 (a.k.a Network)" but it does at layer 2 (a.k.a Data link).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.