I'm trying to find the IP of my other computer on the network for penetration testing, but when I do -sP I get all hosts are up (up to 255), and it doesn't identify any particular IP that is connected to my network...why is this happening? How do I combat this?

  • 1
    What version of nmap are you using? -sP was the command for a ping scan in older versions of nmap. – schroeder Apr 12 '16 at 4:05
  • I'm using the most recent version I believe – Nickolas Kent Apr 12 '16 at 4:24
  • 1
    Then that is your problem. Use the new form: -sn. Please consult the -h help text for your version. – schroeder Apr 12 '16 at 4:27
  • 1
    @schroeder -sP still works, we just prefer everyone to use the new syntax. – bonsaiviking Apr 12 '16 at 12:51
  • Are you sure that you have the IP range of your home network correct? If so, copy the entire output and put it in a pastebin or attachment text. -sP still works in the latest version (its just not as thorough as -sn), it won't specifically produce a 255 hosts up report unless something else is going on. – Jeff Meden Apr 12 '16 at 14:08

A brief from Nmap website:

-sn (No port scan)
This option tells Nmap not to do a port scan after host discovery, and only print out the available hosts that responded to the host discovery probes. This is often known as a “ping scan”, but you can also request that traceroute and NSE host scripts be run. This is by default one step more intrusive than the list scan, and can often be used for the same purposes. It allows light reconnaissance of a target network without attracting much attention. Knowing how many hosts are up is more valuable to attackers than the list provided by list scan of every single IP and host name.

So, the full command will be: nmap -sn and if you're sure about some target, you can use -Pn (No ping scan).

For more info, check Nmap host discovery page.

|improve this answer|||||

To troubleshoot Nmap, it is helpful to gather output from a few different commands:

  • nmap --version; Some older versions have known bugs on certain platforms.
  • nmap --iflist; If Nmap has trouble gathering interface and routing information, it can affect scan results. Compare this output to what is expected from netstat -rn and ifconfig.
  • nmap --route-dst $TARGET; For routing trouble, check where Nmap thinks it should be sending packets.
  • nmap -d --reason $TARGET; Add debugging information and display the reason why Nmap chooses to treat a host as up or down or to give a port an open or closed state.
|improve this answer|||||

Do nmap -O operating system scan to give make model and kernel versions an Iphone should pry show apple but never scanned one they are closed 'end systems but i don't think that matters on a wifi network it will also show MAC address

If you want to know what devices are on the network use nmap

nmap -sT of specific ip address which is a full tcp connect scan it usually returns service port state more accurate

scan for services ie applications using a port that can be exploited use nmap -sV to let you know if any ports are open and what services are running on it.

|improve this answer|||||
  • I'm just trying to scan my in home network and I want to see my other computer and my phone that I know are on the network. – Nickolas Kent Apr 12 '16 at 4:21
  • I already answered about -sP - it's an older command switch that still exists in older tutorials for nmap – schroeder Apr 12 '16 at 4:21
  • Nate - the question was how to find the IP of the other machine, not how to enumerate services. – schroeder Apr 12 '16 at 4:22
  • I see people doing scans and then it shows all the devices on their network and the name of the device. Like if it was my network it would show this computer (named Computer 1 or something of the sort) and then it would show my mac (named Mac Computer or something of the sort), but I can't seem to re-create this on my network. – Nickolas Kent Apr 12 '16 at 4:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.