Using Nessus (an uncredentialed full scan) and Nmap (essentially a full port scan), I am finding a phantom device. This device is supposed to be a well-out-of-commission device, but is returning a computer name when responding to its old IP address. There are no ports found from Nmap. I have asked the guy to look through his DNS records in case there's an old entry for this thing, but I'm not sure what's going on here.

1 Answer 1


Why don't you try a nmap -Pn -p 0-65535 scan against the host. The device may not report any ports because it is not responding to pings. Also, is the dns entry there when you perform a nslookup? What happens when you ping -a the phantom device? Can you track the location to a subnet specific to a switch and then look at the stats on the switch? What does the DNS server say about the hostname or address in question?

I don't think you have done enough enumeration.

  • ah, yes, sorry i was actually using nmap -Pn -p 0-9099,9101-65535 and got this result. I'll get the info off the switch too. thanks for that . Commented Feb 5, 2016 at 17:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .