-sn: It tells the nmap not to do any Port Scan.

-Pn: It tells the nmap not to do any Ping Scan.

Now when I use both together like this, nmap -sn -Pn host.com.

What I saw in the terminal is Nmap is only showing that the "Host is Up".

So, my question is how it tells that the host is UP while I give the flag not to ping any host (-Pn)?. I just only want to understand what was happened behind the results


As you stated, the -Pn flag assumes the host is already 'up' and sends no packets to confirm, while the -sn flag disables port scans entirely.

In summary, what you are doing with a scan like this is attempting a reverse DNS resolution of the host, which attempts to enumerate the name of the host (in this case taking the IP and searching to see if it resolves to a domain name), as it already assumes the host is 'up' and is further instructed to not perform any port scanning.

The reverse DNS resolution is generally attempted to be determined with the help of your resolv.conf file (Unix) or the Registry (Win32).

Further information about this type of scan can be gleaned by either running Wireshark or tcpdump and monitoring the traffic generated from the scan, as well as by passing the -v and --reason flags. Both of these flags will provide additional verbosity and aim to provide more clarity about the output.

The below links are great resources for understanding the anatomy of an Nmap scan.


| improve this answer | |
  • 2
    If you add --reason you will see the target is "up" because of "user-set" which means "I'm telling you it's up because you told me to tell you it's up." – bonsaiviking Jul 18 '18 at 13:39
  • Hi, thanks for answering. Clarify me if I am wrong, the first nmap doing reverse DNS resolution to find out the hostname of the IP, and then we told that the host is already up by specifying (-Pn) and then we instructed not to scan host. (-sn). Am I right? – Utkarsh Agrawal Jul 18 '18 at 14:52
  • 2
    @UtkarshAgrawal The ping scan would ordinarily occur first, but since we tell it not to ping, to simply assume that the host is already up, it passes on to the reverse DNS resolution. Once it does this it moves to port scanning, which we've also instructed it not to do, so then it prints the output of its findings. – waymobetta Jul 18 '18 at 17:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.