12

The nmap man page has this to say about the -sn parameter:

-sn (No port scan) .
    This option tells Nmap not to do a port scan after host
    discovery, and only print out the available hosts that
    responded to the scan.

The first half of the sentence mentions that there is no scan, but the second half says that there is a scan. Is there a different type of scan than a port scan that the second half is referring to? A host-discovery scan perhaps (guessing from the little that I know about nmap)?

12

You're right that the documentation is worded poorly. -sn means "skip the port scan phase," and was previously available as -sP, with the mnemonic "Ping scan".

Nmap scans happen in phases. These are:

  1. Name resolution
  2. NSE script pre-scan phase
  3. Host discovery ("ping" scan, but not necessarily ICMP Echo request)
  4. Parallel reverse name resolution
  5. Port or Protocol scan
  6. Service version detection
  7. OS fingerprinting
  8. Traceroute
  9. NSE portrule and hostrule script scanning phase
  10. NSE post-scan phase

Note that not all these phases get executed in every scan, depending on the arguments. This scan:

nmap -sn scanme.nmap.org

will run phases 1, 3, and 4.

EDIT: I corrected the documentation you referred to in r33790:

This option tells Nmap not to do a port scan after host discovery, and only print out the available hosts that responded to the host discovery probes.

6

In its standard mode, nmap does two different types of scan: a host scan, to determine which hosts are available for further port scanning, and a port scan, which reveals the status of ports on available machines. -sn does no port scan, but it does a host scan -- this is particularly useful when scanning a range with nmap, where it will print out those hosts that responded to the scan (which could, for example, reveal some of the hosts available on a certain subnet).

For example:

$ nmap -sn 192.168.0.0/24

Starting Nmap 6.40 ( http://nmap.org ) at 2013-08-23 17:54 CEST
Nmap scan report for 192.168.0.11
Host is up (0.051s latency).
Nmap scan report for 192.168.0.37
Host is up (0.063s latency).
Nmap scan report for 192.168.0.65
Host is up (0.016s latency).
Nmap scan report for 192.168.0.85
Host is up (0.00090s latency).
Nmap scan report for 192.168.0.149
Host is up (0.024s latency).
Nmap scan report for 192.168.0.202
Host is up (0.021s latency).
Nmap scan report for 192.168.0.253
Host is up (0.042s latency).
Nmap done: 256 IP addresses (7 hosts up) scanned in 22.26 seconds
2

Yes, -sn is a ping scan for host discovery, and does not do any detailed port scan (which ports are open on the host). These are 2 different scans that the man page is talking about. Your interpretation is pretty close.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.