June 4, 2014 - rob

Find live hosts on the network

The simplest way of performing host discovery with nmap.

nmap -sP

Why does it not work all the time ?

When this command runs nmap tries to ping the given IP address range to check if the hosts are alive and if ping fails it tries to send syn packets to port 80 (SYN scan). This is not hundred percent reliable because modern host based firewalls block ping and port 80. Windows firewall blocks ping by default. The hosts you have on the network are blocking ping and the port 80 is not accepting connections. Hence nmap assumes that the host is not up.

So is there a workaround to this problem?

Yes. One of the options that you have is using the -P0 flag which skips the host discovery process and tries to perform a port scan on all the IP addresses (In this case even vacant IP addresses will be scanned) . Obviously this will take a large amount of time to complete the scan even if you are in a small (20-50 hosts) network. but it will give you the results .

The better option would be to specify custom ports for scanning. Nmap allows you to probe specific ports with SYN/UDP packets. It is generally recommended to probe commonly used ports e.g. TCP-22 (ssh) or TCP-3389 (windows remote desktop) or UDP-161 (SNMP).

sudo nmap -sP -PS22,3389 //custom TCP SYN scan
sudo nmap -sP -PU161 //custom UDP scan

N.B. even after specifying custom ports for scanning you may not get an active host. A lot depends on how the host is configured and which services it is using. So you just have keep probing with different combinations.Remember, do not performs scans on a network without proper authorization.

update: When scanning a network you can never be sure that a particular command will give you all the desired results. The approach should be to start with basic ping sweep and if it doesn’t work try guessing the applications that may be running on the hosts and probe the corresponding ports.The Idea of using Wireshark is also interesting. you may want to try sending ACK packets.

nmap -sP -PA21,22,25,3389 //21 is used by ftp