As you stated, the -Pn
flag assumes the host is already 'up' and sends no packets to confirm, while the -sn
flag disables port scans entirely.
In summary, what you are doing with a scan like this is attempting a reverse DNS resolution of the host, which attempts to enumerate the name of the host (in this case taking the IP and searching to see if it resolves to a domain name), as it already assumes the host is 'up' and is further instructed to not perform any port scanning.
The reverse DNS resolution is generally attempted to be determined with the help of your resolv.conf
file (Unix) or the Registry
(Win32).
Further information about this type of scan can be gleaned by either running Wireshark or tcpdump
and monitoring the traffic generated from the scan, as well as by passing the -v
and --reason
flags. Both of these flags will provide additional verbosity and aim to provide more clarity about the output.
The below links are great resources for understanding the anatomy of an Nmap scan.
Sources: