0

-sn: It tells the nmap not to do any Port Scan.

-Pn: It tells the nmap not to do any Ping Scan.

Now when I use both together like this, nmap -sn -Pn host.com.

What I saw in the terminal is Nmap is only showing that the "Host is Up".

So, my question is how it tells that the host is UP while I give the flag not to ping any host (-Pn)?. I just only want to understand what was happened behind the results

1 Answer 1

3

As you stated, the -Pn flag assumes the host is already 'up' and sends no packets to confirm, while the -sn flag disables port scans entirely.

In summary, what you are doing with a scan like this is attempting a reverse DNS resolution of the host, which attempts to enumerate the name of the host (in this case taking the IP and searching to see if it resolves to a domain name), as it already assumes the host is 'up' and is further instructed to not perform any port scanning.

The reverse DNS resolution is generally attempted to be determined with the help of your resolv.conf file (Unix) or the Registry (Win32).

Further information about this type of scan can be gleaned by either running Wireshark or tcpdump and monitoring the traffic generated from the scan, as well as by passing the -v and --reason flags. Both of these flags will provide additional verbosity and aim to provide more clarity about the output.

The below links are great resources for understanding the anatomy of an Nmap scan.


Sources:

3
  • 2
    If you add --reason you will see the target is "up" because of "user-set" which means "I'm telling you it's up because you told me to tell you it's up." Jul 18, 2018 at 13:39
  • Hi, thanks for answering. Clarify me if I am wrong, the first nmap doing reverse DNS resolution to find out the hostname of the IP, and then we told that the host is already up by specifying (-Pn) and then we instructed not to scan host. (-sn). Am I right? Jul 18, 2018 at 14:52
  • 2
    @UtkarshAgrawal The ping scan would ordinarily occur first, but since we tell it not to ping, to simply assume that the host is already up, it passes on to the reverse DNS resolution. Once it does this it moves to port scanning, which we've also instructed it not to do, so then it prints the output of its findings.
    – jonroethke
    Jul 18, 2018 at 17:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .