I want to find out how -PS works for service discovery very well when there are the stealth scan options such as -sS, available in nmap.

I am currently testing nmap.scanme.org and I know there is a full TCP handshake on some ports so a stealth scan is advised but -PS seems to give me just what I am looking for, service name on the port.

"The -P* options (which select ping types) can be combined. You can increase your odds of penetrating strict firewalls by sending many probe types using different TCP ports/flags and ICMP codes."

This is what caught my attention from the man page of nmap. I still don't see how it is possible for -PS to perform this fast and indeed successful when you also take into consideration the -sS option. ICMP codes may be the culprit but I am not sure to be honest.

  • 2
    Have you read the man pages? What bit didn't you understand?
    – Rory Alsop
    Jun 20 at 12:41
  • @RoryAlsop A three way handshake and closing of the connection follows when you look for a port's availability. Here, -PS usage does seem to be successful when -sS is logically needed in order to avoid the issue in my first sentence here. I have read the --help only, sorry. I will be checking further. Jun 20 at 13:23


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.