I ran an nmap -sn scan on a host, and nmap reported the host as down. I then pinged the same host with ping and got ICMP responses. I'm confused, because I was sure that -sn among other things, did an ICMP echo request.

Output from my two commands:

~ $ nmap -sn 

Starting Nmap 6.40 ( http://nmap.org ) at 2016-08-16 09:35 BST
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 3.00 seconds

~ $ ping
PING ( 56(84) bytes of data.
64 bytes from icmp_seq=1 ttl=128 time=9.82 ms
64 bytes from icmp_seq=2 ttl=128 time=5.25 ms
64 bytes from icmp_seq=3 ttl=128 time=2.95 ms
64 bytes from icmp_seq=4 ttl=128 time=9.10 ms
--- ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3004ms
rtt min/avg/max/mdev = 2.957/6.785/9.826/2.810 ms

Any ideas why NMAP could be confused? I'm running the scan from my Ubuntu 16.04 box, the target is a Windows 10.

  • Try -T2 --scan-delay 1s --reason -n -Pn -sO -p1 or even -T2 --scan-delay 1s --reason -n -Pn -sP
    – atdre
    Commented Aug 21, 2016 at 20:50
  • The flags -T2 --scan-delay 1s --reason -n -Pn -sP I don't thing do anything of value unless combined with others? It boils down to just -sP -Pn. And sP is just the old flag for -sn. So it's basically asking for a service scan without a ping or port scan. So it returns "host is up" on anything ip. nmap -s0 -Pn -n returns Host is up.
    – Chris
    Commented Jun 20, 2020 at 4:53

1 Answer 1


If you want to run a ping scan, make sure you are running as root.

From nmap archived docco:

When you run an Nmap ping scan as root, the default is to use the ICMP and ACK methods. Non-root users will use the connect() method, which attempts to connect to a machine, waiting for a response, and tearing down the connection as soon as it has been established (similar to the SYN/ACK method for root users, but this one establishes a full TCP connection!)

So you need

sudo nmap -sn 

Your ping will have the SUID bit set, so that it always runs as root no matter which user you execute it under. This is why it is possible for ping to detect the server, whereas nmap cannot.

  • 1
    Current reference says "For unprivileged Unix shell users, the default probes are a SYN packet to ports 80 and 443 using the connect system call." Commented Aug 16, 2016 at 19:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .