when im using nmap for network discovery , i dont understand theses options

  1. PS
  2. PA
  3. PU
  4. n

when i use -PS or PA or PU ? and what is the difference between them ?

  • It is not clear what your question here is which is not answered by the documentation you refer to. Please read the explanation there closer, specifically the paragraph starting with: "The reason for offering both SYN and ACK ping probes is to maximize the chances of bypassing firewalls. Many administrators configure routers....". This paragraph explains the difference well. If you then still have question please ask a more focused question, i.e. pointing out specifically what is still unclear after reading the documentation. – Steffen Ullrich Sep 1 '18 at 23:53
  • @SteffenUllrich thanks bro , well im not good in english , im sorry .. but i wanna know when do i use -PS or -PA options in nmap ? – Demon512 Sep 2 '18 at 7:47
  • While you might not be good in English you were hopefully able to understand my comment which pointed you to the exact part of the documentation (you've referenced) where the reason for -PA vs. -PS is explained in detail. In short: to pass through some routers/firewalls you need -PS, for others -PA. When to use which: depends on the firewall you face. – Steffen Ullrich Sep 2 '18 at 7:53
  • @SteffenUllrich Thanks Alot brooooo , thanksssss, another ques ,how do i know that the firewall accept -PA and doesnt accept -PS ? – Demon512 Sep 2 '18 at 9:16
  • by trying what works – Steffen Ullrich Sep 2 '18 at 9:59

According to this answer, Nmap consider all the responses using options -P* as an indication that the server is up.

The difference between -P* options are related to the difference of packets types that's been used:

  • -PS TCP SYN Ping
  • -PA TCP ACK ping
  • -PU UDP ping
  • -PY SCTP Init Ping
  • -PE ICMP echo ping

And many other types you can find in this link

  • thanks alot bro answering , but i all i want to know , when do i use -PS or -PA -PE ? – Demon512 Sep 2 '18 at 7:48
  • It's mostly related to your case and what are you scanning, you should search for the difference between TCP SYN, TCP ACK, and other types, try to find especially the response and what does it indicate. Also sometimes you may need to try many types, which indicate also to specific cases, like port closed, filtered, or others. – Emadeddin Sep 2 '18 at 8:00
  • Please consider checking the question as answered if you found what you're seeking. Welcome bro. – Emadeddin Sep 2 '18 at 10:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.