CCNA Scanning and Host Discovery Questions

The -T0 (Paranoid) and -T1 (Sneaky) timing templates drastically reduce the scan speed, sending packets with long delays between them. This makes the scan traffic less likely to trigger rate-based IPS signatures, which often flag rapid port scans. Slowing down is a classic evasion technique that helps avoid detection by network security devices.

TCP SYN ping sends a SYN packet to common ports, effectively bypassing ICMP-only filters. Because it does not complete a full three-way handshake, it is significantly stealthier than a full TCP connect scan. This technique is a standard industry method for host discovery in hardened, filtered network environments.

The -sV option enables service version detection, which probes the open port and analyzes the responses to identify the application name, version, and sometimes additional details. Combined with -p 80, it targets the HTTP service specifically, making it the correct choice for identifying the web server version.

The TCP ACK scan sends ACK packets to target ports. A stateful firewall will typically drop unsolicited ACKs, resulting in a 'filtered' state, while a stateless firewall may allow them and the host will respond with RST, showing 'unfiltered'. By analyzing whether ports are filtered or unfiltered, you can infer the firewall's nature, making this the correct choice.

The -Pn flag instructs Nmap to treat all hosts as online. It skips the ping discovery phase entirely, allowing the scanner to attempt port probes on every target regardless of whether they respond to ICMP. This is necessary for scanning hosts that are protected by ICMP-blocking firewalls.

The SYN scan is the 'half-open' technique that identifies open ports by initiating the handshake but never finishing it. By sending a RST packet upon receiving a SYN/ACK, it avoids creating a full connection entry in the target's socket table, which is the standard behavior for most Nmap scans.

-sn (No port scan) tells Nmap to perform only host discovery and skip port scanning. This is the correct and current option for a ping sweep. It sends various probes (ICMP echo, TCP SYN to 443, TCP ACK to 80, ICMP timestamp) to determine if hosts are up, and it is much faster than scanning ports on every host.

ARP ping (-PR) sends ARP requests, which are Layer 2 broadcasts and are not routed or inspected by most network IDS/IPS. On a flat Layer 2 segment, every live host must answer with its MAC address, so this reliably identifies hosts without generating TCP SYN traffic that would trigger the IDS. It is the default host discovery method for local Ethernet targets.

A TCP SYN scan (-sS), also known as a half-open scan, sends a SYN packet and analyzes the response without completing the handshake. It is fast, stealthy, and less likely to be logged by the target application. Since you have root privileges, this is the appropriate choice to avoid IPS signatures associated with full connections.

With root privileges, a TCP SYN ping (-PS) to commonly open ports such as 22, 80, and 443 will elicit a SYN/ACK or RST from live hosts even when ICMP is filtered, and -sn disables port scanning so the run stays fast. This directly addresses the firewall that drops echo requests.

The NSE is designed to interact with services on an application level, such as sending HTTP requests or querying databases. This provides context beyond simple port status, allowing testers to confirm if a service is actually functioning and to gather metadata like site titles or server versions.

The TCP ACK scan sends ACK packets to target ports. A stateless firewall will typically pass ACK packets or drop them based on simple rules, while a stateful firewall will drop unsolicited ACK packets because they do not belong to an established connection. By comparing responses to ACK packets on allowed and disallowed ports, you can infer whether the firewall is stateful.

This result occurs when Nmap sends a probe and receives no response. It could be that the port is open and the service is not replying, or that a firewall is filtering the traffic. The lack of feedback prevents Nmap from giving a definitive status, creating a state of uncertainty.

When the same service responds locally but not across a router, the most likely explanation is an intermediate firewall or ACL dropping TCP/445. The scan itself is valid; the network path is filtering the probe or its response, which is why the port appears filtered or unreachable from the remote subnet.

The -sn option tells Nmap to perform host discovery only, without port scanning. It sends probes like ICMP echo, TCP SYN to port 443, TCP ACK to port 80, and ICMP timestamp to determine if hosts are up. This is exactly what is needed to identify live hosts on a subnet without scanning ports.

The -PS option performs a TCP SYN ping to the specified ports. Hosts that are up will respond with a SYN/ACK (if the port is open) or RST (if closed), allowing discovery even when ICMP is filtered. Combining -sn with -PS22,80,443 targets common open ports, making it highly effective in this scenario where ICMP is blocked.

Because UDP does not utilize a handshake, the scanner must guess if a port is open based on the presence of a response or an ICMP port unreachable message. If the packet is simply dropped by the target, the status remains ambiguous, leading to significant delays and potential errors.