I want to find out how
-PS works for service discovery very well when there are the stealth scan options such as
-sS, available in nmap.
I am currently testing nmap.scanme.org and I know there is a full TCP handshake on some ports so a stealth scan is advised but
-PS seems to give me just what I am looking for, service name on the port.
"The -P* options (which select ping types) can be combined. You can increase your odds of penetrating strict firewalls by sending many probe types using different TCP ports/flags and ICMP codes."
This is what caught my attention from the man page of nmap. I still don't see how it is possible for
-PS to perform this fast and indeed successful when you also take into consideration the
-sS option. ICMP codes may be the culprit but I am not sure to be honest.