I am trying to do a nmap scan on a machine in my home network. When I do the regular scan (using nmap 192.168.2.10
or nmap -sP 192.168.2.10
), the results say host is down. However, when I use the option -Pn
, I get the result saying host is up. What does this mean? I tried reading what the -Pn
option does at nmap's website but I didn't understand it. It says that -Pn
option disables host discovery. How does that affect my scan?
1 Answer
Don't know really how to explain it differently as I think the nmap page explains it ok, but basically...
Some hosts respond to pings if they are online (I.e. ping www.google.com and you get a reply.)
Nmap tries pinging them, if they respond nmap continues scanning and you get your result. If it gets no response it says 'hmm they must be down, well no point wasting time scanning someone who doesn't exist' and exits.
Now some hosts are alive, but configured not to answer to pings. Under normal circumstances this means nmap would simply not scan them thinking they were down. If you specify -Pn it skips this initial stage of checking if the host is up and basically says 'well I've been told to scan no matter what, so even if I think it's down* my stupid human operator is making me do it anyway'. It then tries to scan and actually gets results because in reality the host is alive.
*saying it thinks its down is slightly incorrect - if simply ignores the check in the first place.
Summary - skips checking if the host is alive which may sometimes cause a false positive and stop the scan.
-
I understood in the way you explained it to me. I have a few more questions about the -Pn option. Can we chat? Mar 3, 2013 at 5:29
-
1If you have questions ask here so anyone searching for the same answers can benefit.– PeleusMar 3, 2013 at 6:42
-
-
2When most people see "ping," they think of ICMP Echo Request, but Nmap uses many other probes for host discovery, too. The default set of 4 probes (or ARP request on LAN) is overwhelmingly likely to find a host that is up, so you should very rarely ever need to use the
-Pn
option. Mar 3, 2013 at 13:15
ICMP ping block on the WAN port
does so. The firewall also dropped my FIN packets (-sF scan of nmap). I don't really know how to change the firewall rules for unblocking these types of scans. Anyways, I didn't really get what type of scans these scanners were doing (I'll have to read the source ofAngry IP Scanner
) but now I know why the -Pn option gives the host as up (even if the IP isn't assigned)