To what extent can an attacker generate a map of a network from outside of it?
Are network scanning tools such as nmap the only means to do this? Otherwise what other types of tools or techniques could be used?
Say you have a network with internet facing servers in a DMZ, the internal network, then internal servers in a special subnet. Is it possible to prevent attacks outside the network from learning the IP addresses of the internal servers?
What could you do to prevent this?
NOTE: I am aware that too much effort should not go into hiding this information, I am just curious and wish to learn more about what is possible.
I am also aware there are a variety of ways to gather the addresses of the internal servers in my scenario, I am only interested in the scanning aspect however.