Nmap Discovery - Part 4
I can Nmap help here.
And if we go down here, we can see PE, PP, PM.
So these are discoveries by ICMP echo, timestamp and net mask request discovery probes.
So if we go here, we can see an example of a PE and P is an ICMP echo.
So ICMP echo also we're suppressing the scans.
So this is only doing a discovery via ICMP echo, and we've got the both.
Enter there and what are we find so we can see we've got no response, no response to all of those.
And then we can start to see the odd machine that is there on the local network.
And if we go back to help again, and I can see minus PO protocol list, IP protocol ping, which sends IP packets with the specified protocol number set in their IP header.
Now, if no protocols are specified, the default is to send multiple IP packets from ICMP protocol one, RTMP protocol, two and IP in IP protocol one.
So if we click here, this is the syntax for it.
We've got the -PO and as I said, if we leave that blank, it'll do as default one, two, and four, but we've specified here one, two, and four, and we're suppressing the scan afterwards.
So this will just do a discovery on those ports.
So let's give that a go and let's just go over these hosts here. 1, 2, 3, 4, 5, 6, and you can see there six hosts. up, here we have Nmap and then the targets and then minus capital P then minus capital R, that actually isn't on the help.
You only find that if you dig through the references, then we've got minus S N, which means we're going to suppress the scan and we've got our verbose.
So what is this PR doing? Well, this is an ARP scan.
Only when you're on a local internal network.
You can do an ARP ping and that's all.
This is. And this is done by default on an ethernet local network is much faster than the IP discovery.
If it gets a response back Nmap, doesn't even need to worry about the IP based ping packets, since it already knows the host is, ARP, this is the fastest way to do discovery of hosts on a local network of a press return here.
That's doing the whole 255 and it's found six hosts to be up by using ARP instead of IP.
I can Nmap help here. We can see the minus N minus R, so this has never do DNS resolution always resolve also quite interesting.
We can actually choose the DNS servers and in combination with this list scan where we simply list the targets to scan, as opposed to scan them, we can do a reverse DNS look at, we can change the DNS server to be the local DNS on, for example, a local net.
Like you can see here.
And this is basically going to tell us what's on the network in terms of network names, there's a reverse DNS lookup, and this can potentially tell us useful information so we can see here, we've got this Kali box and iPhone something else.
There John's something router, et cetera.
And we can use the OSS DNS resolver, and there's also traceroute, which can come in useful from time to time.
So here we can see we're doing three random host.
We're suppressing the actual scan and just doing the discovery.
The reason I to suppress a lot of the scans in this is so that you understand that this is the discovery phase that we're talking about here and not the scanning phase, which can be a little bit confusing.
Some people mix up the discovery and the scanning.
They are separate phase.
So we are suppressing the scanning here and doing some trace routes to three random hosts.
And let's see what sort of results that we get back.
There we go. We can see one host is up and we can see that route through to that host.
And if you're using Zen map that can help graphically to represent where certain devices.
So there you go.
That's the discovery stage, the stage before the actual scanning is done to make sure that the host is actually alive and active first, before you start the scan, which are these here for the scan techniques.