# Scanning Networks

> Chapter 3 of the Courseiva EC-CEH curriculum — https://courseiva.com/learn/ec-ceh/scanning-networks

**Official objective:** 2.2 — Perform network scanning to discover live hosts, open ports, and services using tools like Nmap and various scanning techniques.

## Introduction

Exam objective 2.2 of the CEH 312-50 exam focuses on scanning networks, a skill that transforms a complete unknown into a detailed map of targets, much like a reconnaissance mission before a battle. Scanning networks matters because an attacker must identify which systems are alive, which doors (ports) are open, and what services are running before they can plan an attack, making this the foundational step in any ethical hacking engagement.

## The Property Detective Analogy

A property detective is hired by a security company to assess a large, unfamiliar office building. The detective's job is to find out everything about the building without going inside or setting off any alarms. First, the detective walks around the block, noting the main address (the IP address) and seeing if the building looks occupied — lights on, cars in the lot (discovering live hosts). Next, they check all the doors and windows, gently testing each one to see if it’s locked, unlocked, or slightly ajar (scanning open ports). They pay special attention to certain doors: the main delivery entrance (port 80 for HTTP), the secure server room door (port 443 for HTTPS), and the IT staff’s back entrance (port 22 for SSH). Each open door reveals a service — a delivery service, a web hosting service, or a remote administration service. The detective notes whether the door is completely open, partially open, or filtered by a heavy security gate (a firewall). A completely open door might be a vulnerability, while a filtered one means the building has defences. The detective also varies their approach: sometimes they knock loudly (a noisy scan), sometimes they tap very softly (a stealth scan), and sometimes they pretend to be a maintenance worker (a decoy scan) to avoid being logged by the building’s security cameras (intrusion detection systems). Building managers often leave doors open by mistake — misconfigured ports — and the detective’s job is to find those mistakes before a real thief does.

The property detective does not break in; they simply create a map of every potential entry point. This map is the scanning report, which helps the security company decide which locks to upgrade and which doors to seal permanently.

## Core explanation

Scanning networks is the process of probing a range of computers (hosts) on a network to discover which ones are active, what network services they offer, and which application doors (ports) are open for business. Think of a network as a city full of houses. Each house has a unique postal address (an IP address). Your own machine is one house, and you want to find out which neighbouring houses are occupied (live hosts) and which have their front doors unlocked (open ports).

To understand scanning, you must first understand IP addresses and ports. An IP address is a numerical label assigned to each device connected to a network, like 192.168.1.10. It identifies the specific computer, just as a street address identifies a house. Ports are numbered virtual entry points on that computer, ranging from 0 to 65535. Each port is typically assigned to a specific service. For example, port 80 is the standard port for web traffic (HTTP), port 443 is for secure web traffic (HTTPS), port 22 is for the secure shell service (SSH) used to control computers remotely, and port 21 is for the file transfer protocol (FTP). When a service is running, it ‘listens’ on its assigned port, waiting for a connection.

The most famous tool for this job is Nmap, short for ‘Network Mapper’. Nmap sends specially crafted packets (small chunks of data) to target IP addresses. By analysing how the target responds, Nmap can tell if the host is alive, which ports are open, what operating system it is running, and even what version of a service is installed.

There are several fundamental scanning techniques that the CEH exam tests. The three most common are:

- TCP Connect Scan: This completes the full three-way handshake of the TCP protocol. The three-way handshake is how two devices establish a reliable connection. It starts with your machine sending a SYN (synchronise) packet. The target replies with a SYN-ACK (synchronise-acknowledge) packet if the port is open. Your machine then sends an ACK (acknowledge) packet to finish the connection. A TCP Connect scan completes this entire handshake, which is reliable but noisy — it is logged by the target system and easily detected by firewalls.

- SYN Scan (also called Stealth Scan or Half-Open Scan): This sends only the initial SYN packet. If the target responds with a SYN-ACK, your machine knows the port is open, but it never sends the final ACK. Instead, it sends a RST (reset) packet to tear down the connection. This is faster and less likely to be logged because the full connection is never established. It is the default scan type in Nmap.

- UDP Scan: The User Datagram Protocol (UDP) is a connectionless protocol used by services like DNS (port 53) and DHCP. Because UDP does not use a handshake, scanning it is trickier. Nmap sends a UDP packet to a port. If it gets no response, the port might be open or filtered. If it gets an ICMP Port Unreachable message, the port is clearly closed. UDP scanning is inherently slower and less reliable than TCP scanning.

Why does scanning exist? Without scanning, a penetration tester would be blindly guessing which systems are vulnerable. Scanning replaces guesswork with intelligence. It allows a tester to create a precise inventory of all live hosts, their open doors, and the software versions behind those doors. This inventory is then used to look up known vulnerabilities in databases like the Common Vulnerabilities and Exposures (CVE) list.

Scanning also involves discovering the operating system. Nmap uses a technique called OS fingerprinting, where it examines subtle differences in how a machine responds to malformed packets. Different operating systems (Windows, Linux, macOS) have slightly different stacks — their implementations of the TCP/IP protocol. By analysing these tiny variations, Nmap can guess the operating system with surprising accuracy.

Finally, scanning includes service and version detection. Connecting to an open port and sending a few probes can make the service reveal its name and version number. For example, connecting to port 80 and sending an HTTP GET request often returns a banner like ‘Apache/2.4.41 (Ubuntu)’. This banner tells you the web server software and its version, which is critical for finding known vulnerabilities.

## Real-world context

Imagine you are hired as a junior penetration tester for a medium-sized company called ‘GreenLeaf Retail’. They run an online store and have asked you to perform an external security assessment — meaning you are testing from outside their network, the same way a real attacker would. The company has given you a range of IP addresses (e.g., 203.0.113.1 to 203.0.113.20) and asked you to find all live systems, open ports, and running services.

Your first step is to run a live host discovery scan. You use Nmap on your laptop with a simple command: nmap -sn 203.0.113.1-20. The -sn flag tells Nmap to perform a ping sweep, sending ICMP echo requests (the same kind of ping you use to test internet connectivity) to each IP. Nmap waits for replies. In a few seconds, you get back a list of five IP addresses that responded. The other fifteen are either offline or configured to ignore ping requests.

Next, you choose a SYN scan against the five live hosts: nmap -sS 203.0.113.1-5 -p 1-1000. The -sS flag invokes SYN scan, and -p 1-1000 limits scanning to the first 1000 most common ports to save time. The scan runs for a few minutes. The results show that host 203.0.113.3 has ports 22 (SSH), 80 (HTTP), and 443 (HTTPS) open. Host 203.0.113.5 has port 3389 open, which is the Remote Desktop Protocol (RDP) — a concerning finding, as RDP is a frequent target for attackers if not properly secured.

You then run a more detailed version scan on those specific hosts: nmap -sV 203.0.113.3 -p 22,80,443. The -sV flag tells Nmap to probe each open port to determine the exact software and version. The results come back: port 80 is running Apache HTTP Server 2.4.29, and port 443 is running OpenSSL 1.1.1. You now have actionable intelligence. You check a vulnerability database (like the CVE list) and find that this version of OpenSSL is vulnerable to a known buffer overflow attack.

In a real engagement, you would document everything in a report. You would note that one host exposes RDP to the internet, which is a high-risk finding. You would recommend that the company disable RDP or restrict it via a VPN. You would also flag the outdated OpenSSL version and recommend an immediate patch.

You would also perform a stealthy scan during off-peak hours to avoid disrupting business operations. The scan might trigger an intrusion detection system (IDS) — the company’s security team would see a spike in connection attempts. In a professional red-team exercise, you would coordinate this with the blue team to avoid false alarms.

Key actions you perform repeatedly:
- Run a ping sweep to discover live hosts.
- Run a SYN scan to identify open ports efficiently.
- Run a version scan to fingerprint services.
- Cross-reference findings with vulnerability databases.
- Write a clear, prioritised report for the client.

## Exam focus

The 312-50 exam tests scanning networks extensively because it is the gateway to all further exploitation. Expect multiple-choice questions that test your understanding of different scan types, the flags used in Nmap, and the subtle differences between responses. The exam loves to ask: ‘Which Nmap flag performs a SYN scan?’ The answer is -sS. Or, ‘Which scan type completes the full three-way handshake?’ That is the TCP Connect scan (-sT).

One common trap is the distinction between a SYN scan and a TCP Connect scan. The exam will present a scenario: ‘You want to avoid being logged by the target system. Which scan type should you use?’ The correct answer is SYN scan because it never completes the handshake. Many beginners mistakenly choose TCP Connect because they remember the word ‘connect’, but that is the noisy, logged option.

Another frequent topic is the state of ports. The exam expects you to know the six port states Nmap reports:
- Open: The port is open and a service is listening.
- Closed: The port is accessible but no service is listening.
- Filtered: A firewall, a filter, or some network obstacle is blocking the probe.
- Unfiltered: The port is accessible, but Nmap cannot determine if it is open or closed.
- Open|Filtered: Nmap cannot determine if the port is open or filtered.
- Closed|Filtered: Nmap cannot determine if the port is closed or filtered.
You will be asked to interpret a scan result and identify the state. For example, if a probe gets no response, the port might be filtered or the host might be down.

The exam also tests your knowledge of the three-way handshake. You must memorise the sequence: SYN, SYN-ACK, ACK. A trick question might say: ‘You receive a SYN-ACK packet. What does this indicate about the port?’ The answer: the port is open. Another trick: ‘You receive a RST packet immediately after sending a SYN. What does this mean?’ The answer: the port is closed, and the target is actively refusing the connection.

Service and version detection (-sV) is another high-yield topic. The exam may ask: ‘Which Nmap option identifies the version of a service running on an open port?’ Answer: -sV. They might also ask about OS detection (-O) and the script scanner option (-sC).

Finally, the exam tests your ability to choose the right scan for a given scenario. You might see: ‘You are scanning a network that uses a stateful firewall. Which scan type is most likely to bypass it?’ The answer is a SYN scan, because stateful firewalls track full connections and may allow half-open connections through. Conversely, a TCP Connect scan would be recorded and potentially blocked.

Key concepts to memorise:
- Nmap flag syntax: -sS (SYN), -sT (TCP Connect), -sU (UDP), -sV (version), -O (OS), -sn (ping sweep), -p (port range).
- The three-way handshake sequence: SYN, SYN-ACK, ACK.
- Port states: open, closed, filtered, unfiltered, open|filtered, closed|filtered.
- The difference between ICMP echo scanning and TCP SYN ping.
- How to perform a stealth scan and why it is less detectable.

## Step by step

1. **Define the Target Scope** — Before running any scan, you must know the range of IP addresses you are authorised to test. This is usually a contiguous block, e.g., 192.168.1.1-254. Having a clear scope prevents accidental scanning of systems outside the agreement, which could be illegal.
2. **Discover Live Hosts (Ping Sweep)** — Use Nmap with the -sn flag to send ICMP echo requests, TCP SYN pings, or ARP probes to the entire range. Only hosts that respond are alive. This narrows down the list of targets so you do not waste time scanning offline machines.
3. **Perform Port Scanning on Live Hosts** — Run a SYN scan (nmap -sS) against the list of live IPs, optionally specifying a port range with -p. This reveals which ports are open, closed, or filtered. Focus on common ports (1-1024) first, then expand to higher ports if needed.
4. **Identify Services and Versions** — Use nmap -sV on the open ports to query the listening service. The service might respond with a banner containing the software name and version, such as ‘Apache 2.4.41’. This information is used to find known vulnerabilities in databases like CVE.
5. **Detect the Operating System** — Run nmap -O to attempt OS fingerprinting. Nmap analyses subtle differences in packet responses to guess whether the host runs Windows, Linux, macOS, or another OS. This helps tailor further attack strategies, as exploits are often OS-specific.
6. **Document and Report Findings** — The final step is to compile all results into a clear report listing each live host, its open ports, the service versions, and the estimated OS. The report should highlight high-risk findings, such as remote desktop services exposed to the internet, and provide remediation recommendations.

## Comparisons

### TCP Connect Scan (-sT) vs SYN Scan (-sS)

**TCP Connect Scan (-sT):**
- Completes the full three-way handshake (SYN, SYN-ACK, ACK)
- Easily logged by the target system's event logs
- Slower because it requires establishing a full connection

**SYN Scan (-sS):**
- Sends only the initial SYN packet and then a RST to tear down
- Less likely to be logged because no full connection is made
- Faster than TCP Connect scan

### ICMP Ping Sweep (-sn) vs TCP SYN Ping

**ICMP Ping Sweep (-sn):**
- Uses ICMP echo request packets (the standard ping)
- Often blocked by firewalls and modern host firewalls
- Cannot detect hosts that disable ICMP

**TCP SYN Ping:**
- Sends a SYN packet to a commonly open port (e.g., port 80 or 443)
- Can bypass firewalls that allow outbound TCP traffic
- Detects hosts even if ICMP is disabled, as long as a service is listening

### Open Port vs Filtered Port

**Open Port:**
- A service is actively listening on the port
- Nmap receives a SYN-ACK response (for TCP) or a response from the UDP service
- Directly exploitable if the service has vulnerabilities

**Filtered Port:**
- Nmap receives no response or an administrative prohibition message
- A firewall is likely blocking or dropping packets to this port
- Unknown whether a service is behind the firewall; cannot directly exploit

### Service Version Detection (-sV) vs OS Detection (-O)

**Service Version Detection (-sV):**
- Probes open ports to determine the exact software and version (e.g., Apache 2.4.41)
- Requires connecting to the service and sending probes
- Used to find vulnerabilities specific to software versions

**OS Detection (-O):**
- Analyses packet response patterns to guess the operating system (e.g., Windows 10, Linux 5.4)
- Uses techniques like TCP/IP stack fingerprinting
- Used to tailor exploits to the target's OS

## Diagram

_A flowchart showing the sequential steps of a typical network scanning process, from defining the target range to compiling the final report._

```mermaid
flowchart TD
    A[Define Target IP Range] --> B[Ping Sweep -sn]
    B --> C{Live Host?}
    C -->|Yes| D[SYN Scan -sS on ports]
    C -->|No| E[Skip Host]
    D --> F[Port State: Open/Closed/Filtered]
    F --> G[Version Detection -sV]
    G --> H[Service Name and Version]
    H --> I[OS Detection -O]
    I --> J[Compile Report]
```

## Common misconceptions

- **Misconception:** A SYN scan is completely invisible to the target and will never be detected. **Reality:** A SYN scan is stealthier than a full TCP Connect scan because it does not complete the handshake, but it still sends packets that can be logged by firewalls and intrusion detection systems. It is not truly invisible. (Newcomers see the word ‘stealth’ and assume absolute invisibility, but network monitoring tools can still detect the pattern of unsolicited SYN packets.)
- **Misconception:** An open port always means a vulnerability exists. **Reality:** An open port only means a service is listening. The service might be patched and secure. A vulnerability depends on the specific version and configuration of the service, not just the open port itself. (Beginners often conflate ‘open’ with ‘dangerous’ because they learn about exploiting open ports. But many open ports, like port 443 (HTTPS), are essential and safe when properly configured.)
- **Misconception:** Nmap can scan any host on the internet without any restrictions. **Reality:** Nmap sends packets that can be blocked by firewalls, filtered by network address translation (NAT), or limited by rate limiting. Many networks also block ICMP ping packets entirely, making ping sweeps unreliable. (People assume scanning is always possible because they see Nmap work on their local home network. Real-world networks have defensive layers that interfere.)
- **Misconception:** A closed port is safe and can be ignored. **Reality:** A closed port means no service is listening, but the host is still reachable and can still be attacked through other vectors. Also, a closed port might unexpectedly open later if a service crashes and restarts. (Beginners think closed equals ‘no risk’, but the host itself may still be vulnerable through other means, like unpatched software or weak credentials.)
- **Misconception:** The only way to discover live hosts is to use ICMP ping. **Reality:** ICMP ping is one method, but many hosts are configured to ignore ICMP. Nmap also uses TCP SYN pings (to port 80 or 443), UDP pings, and ARP pings (on local networks) to discover live hosts when ICMP fails. (People learn ‘ping’ from basic networking and assume it is the definitive test of a host being alive, but advanced scanning uses multiple probes to circumvent filtering.)
- **Misconception:** A UDP scan is just as fast and reliable as a TCP SYN scan. **Reality:** UDP scanning is inherently slower and less reliable because UDP is connectionless. Open UDP ports often do not respond, while closed ports send an ICMP Port Unreachable message. Many firewalls also drop these ICMP messages, causing false positives. (Beginners assume all protocols behave similarly, but the stateless nature of UDP makes scanning it a fundamentally different challenge.)

## Key takeaways

- Scanning networks is the reconnaissance phase that identifies live hosts, open ports, and running services before any exploitation can begin.
- A TCP SYN scan (half-open scan) is the default and stealthiest TCP scan in Nmap because it never completes the three-way handshake.
- The three-way handshake follows the sequence: SYN (synchronise), SYN-ACK (synchronise-acknowledge), ACK (acknowledge).
- Nmap identifies six port states: open, closed, filtered, unfiltered, open|filtered, and closed|filtered.
- Service version detection using the -sV flag reveals the exact software and version running on an open port, which is critical for vulnerability assessment.
- A ping sweep (nmap -sn) can discover live hosts, but many systems block ICMP, so Nmap uses multiple techniques like TCP SYN ping and ARP ping.
- UDP scanning (nmap -sU) is slower and less reliable than TCP scanning because UDP is connectionless and closed ports often fail to respond.
- Firewalls and intrusion detection systems can detect scanning activity, so professional testers must coordinate with security teams during authorised engagements.

## FAQ

**Do I need permission before scanning a network for the CEH exam or in real life?**

Yes, absolutely. Scanning a network without explicit written permission from the owner is illegal in most jurisdictions and violates computer fraud laws. For the CEH exam, you only scan authorised lab environments.

**Why does Nmap say a port is 'filtered' instead of 'open' or 'closed'?**

Nmap reports a port as 'filtered' when it receives no response or an error message (like ICMP administratively prohibited) that suggests a firewall or packet filter is blocking the probe. Nmap cannot determine whether the port is actually open or closed.

**What is the difference between -sS and -sT in Nmap?**

The -sS flag performs a SYN stealth scan that does not complete the three-way handshake, making it faster and less detectable. The -sT flag performs a full TCP Connect scan that completes the handshake, which is slower and logged by the target system.

**Can I scan a host that is behind a home router or corporate firewall?**

It depends on the firewall rules. Many home routers block inbound scanning packets by default, so you will see filtered ports. Corporate firewalls are even stricter. Scanning will only work if the firewall allows the specific packets you send.

**How long does a typical network scan take?**

It varies wildly. A simple ping sweep of a /24 subnet (254 IPs) takes a few seconds. A full port scan (65535 ports) on a single host with version detection can take several minutes per host. Scanning speed depends on network latency, host responsiveness, and Nmap timing options.

**What does -sC do in Nmap?**

The -sC flag enables the default set of Nmap Scripting Engine (NSE) scripts. These scripts perform additional checks like attempting to log in with default credentials, checking for common vulnerabilities, and gathering more detailed service information.

## Check your understanding

1. **Which Nmap scan type sends a SYN packet and, upon receiving a SYN-ACK, sends a RST instead of completing the handshake?**

   Answer: This is the SYN scan (stealth scan or half-open scan), invoked with the -sS flag in Nmap.

2. **What port state does Nmap report when a firewall has returned an error message like 'administratively prohibited'?**

   Answer: Nmap reports the port as 'filtered', meaning it cannot determine if the port is open or closed because a filter is blocking the probe.

3. **What is the correct sequence of packets in the TCP three-way handshake?**

   Answer: The sequence is SYN from the client, then SYN-ACK from the server, and finally ACK from the client.

4. **If a UDP scan sends a packet to a closed UDP port, what response does it typically receive?**

   Answer: It typically receives an ICMP Port Unreachable message from the target host.

5. **Why is a SYN scan considered 'stealthier' than a TCP Connect scan?**

   Answer: Because a SYN scan never completes the full three-way handshake, so the target's application layer does not log the connection attempt, even if the network layer may still detect the packets.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/ec-ceh/scanning-networks