5

I am trying to determine if hosts are up. For hosts where a ping fails, I run a Nmap (6.40) Regular and/or Quick Scan. For a subset of my hosts, the Nmap response is "Host seems down". As a follow up per the Nmap response, I run the no ping port scan -Pn.

For the -Pn scans, on the 10-15 different hosts I have tried, the response is always: Host is up. All 1000 scanned ports on x.y.z are filtered. Nmap was done: 1 IP address (1 host up) scanned in 205.37 seconds

My question is if the ports are in a filtered status, why is Nmap returning "Host is up"?. I would have guessed that the status returned would have been "Host seems up" or "Unknown". Has Nmap verified that the host is up, and if so, how does Nmap determine that the host is up?

These are the commands I executed:

nmap hostname => Regular Scan
nmap -T4 -F hostname => Quick  Scan
nmap -Pn hostname => No Ping Scan
1
  • Use the --reason flag to show the reason for hosts being shown as "up" and ports being shown as "open" or "closed". Example: Host is up, received user-set. Jan 21, 2014 at 15:23

3 Answers 3

14

Here is the relevant line from the command line help output ofnmap.

-Pn: Treat all hosts as online -- skip host discovery

The -Pn flag allows nmap to assume that the host is online because you told nmap that the host is online.

7

Because you instructed nmap that the host was up. The PN flag tells nmap that, regardless if it can ping the host or not, it should consider the host as up. That's why you read "The host is up".

0
When the Machine Does not respond to ping(ICMP) requests.
So you need to Treat all the hosts as online
The right command would be 


  nmap -Pn <IP>

This command will show all the ports and there services running in that machine

if you want to known more about the nmap command use 



  nmap --help

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .