Experiments

1 min read

Network Discovery

Tools

  • nmap
    • host discovery, port scanning, service/version fingerprinting
  • masscan
    • very fast internet-scale port scanning
  • rustscan
    • fast port discovery then hands off to nmap
  • tcpdump
    • packet capture from terminal for low-level traffic analysis
  • Wireshark
    • GUI packet analysis and protocol inspection
  • netcat or nc
    • manual TCP/UDP connectivity checks and banner grabbing
  • traceroute or tracert (Windows)
    • path and hop-level visibility to target
  • dig
    • DNS query and record inspection
  • whois
    • domain ownership, registrar, and registration context

nmap

  • Network Mapper
  • Network exploration tool and security / port scanner
  • -sn does host discovery only (no port scan)
    • example: find live hosts in local subnet
nmap -sn 192.168.1.0/24
  • -Pn skips ping checks and treats host as up
    • useful when ICMP is blocked by firewall
nmap -Pn 192.168.1.10
  • default scan checks common ports on discovered hosts
nmap 192.168.1.10
  • -p scans specific port or port ranges
nmap -p 22,80,443 192.168.1.10
nmap -p 1-1024 192.168.1.10
  • -sV tries to detect service versions
    • example: tells SSH server version like OpenSSH 9.0p1
nmap -sV 192.168.1.10
  • -O tries to detect operating system
sudo nmap -O 192.168.1.10
  • -A enables aggressive scan (OS + version + script + traceroute)
    • example:
sudo nmap -A 192.168.1.10

Backlinks