How to Scan Alive Host in a Network Segment using nmap command live

By Posted on

This is an article for scanning alive hosts in a certain segment. There is a specific tool to achieve the purpose. The tool is available normally in any Linux operating system. The following are steps for executing the command :

  1. First of all, it is the most important thing. Just check whether the command is available or not in the operating system. Check it by typing the following command in the command line :
user@hostname:~$ nmap
Nmap 7.60 ( https://nmap.org )
Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION:
  Can pass hostnames, IP addresses, networks, etc.
  Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254
  -iL : Input from list of hosts/networks
  -iR : Choose random targets
  --exclude <host1[,host2][,host3],...>: Exclude hosts/networks
  --excludefile : Exclude list from file
HOST DISCOVERY:
  -sL: List Scan - simply list targets to scan
  -sn: Ping Scan - disable port scan
  -Pn: Treat all hosts as online -- skip host discovery
  -PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports
  -PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes
  -PO[protocol list]: IP Protocol Ping
  -n/-R: Never do DNS resolution/Always resolve [default: sometimes]
  --dns-servers <serv1[,serv2],...>: Specify custom DNS servers
  --system-dns: Use OS's DNS resolver
  --traceroute: Trace hop path to each host
SCAN TECHNIQUES:
  -sS/sT/sA/sW/sM: TCP SYN/Connect()/ACK/Window/Maimon scans
  -sU: UDP Scan
  -sN/sF/sX: TCP Null, FIN, and Xmas scans
  --scanflags : Customize TCP scan flags
  -sI : Idle scan
  -sY/sZ: SCTP INIT/COOKIE-ECHO scans
  -sO: IP protocol scan
  -b : FTP bounce scan
PORT SPECIFICATION AND SCAN ORDER:
  -p : Only scan specified ports
    Ex: -p22; -p1-65535; -p U:53,111,137,T:21-25,80,139,8080,S:9
  --exclude-ports : Exclude the specified ports from scanning
  -F: Fast mode - Scan fewer ports than the default scan
  -r: Scan ports consecutively - don't randomize
  --top-ports : Scan  most common ports
  --port-ratio : Scan ports more common than 
SERVICE/VERSION DETECTION:
  -sV: Probe open ports to determine service/version info
  --version-intensity : Set from 0 (light) to 9 (try all probes)
  --version-light: Limit to most likely probes (intensity 2)
  --version-all: Try every single probe (intensity 9)
  --version-trace: Show detailed version scan activity (for debugging)
SCRIPT SCAN:
  -sC: equivalent to --script=default
  --script=:  is a comma separated list of
           directories, script-files or script-categories
  --script-args=<n1=v1,[n2=v2,...]>: provide arguments to scripts
  --script-args-file=filename: provide NSE script args in a file
  --script-trace: Show all data sent and received
  --script-updatedb: Update the script database.
  --script-help=: Show help about scripts.
            is a comma-separated list of script-files or
           script-categories.
OS DETECTION:
  -O: Enable OS detection
  --osscan-limit: Limit OS detection to promising targets
  --osscan-guess: Guess OS more aggressively
TIMING AND PERFORMANCE:
  Options which take

2. The command represents the tool with the name ‘nmap’ is exist according to the above output. Just re-execute the command with specific attribute or parameter for scanning alive host in a certain segment using the following pattern :

nmap -sP network_segment

For an example : 

root@hostname:~$ nmap -sP 192.168.1.0/24
Starting Nmap 7.60 ( https://nmap.org ) at 2018-11-26 10:11 
Nmap scan report for 192.168.1.1
Host is up (0.0058s latency).
Nmap scan report for 192.168.1.2
Host is up (0.0049s latency).
Nmap scan report for 192.168.1.3
Host is up (0.0028s latency).
Nmap scan report for 192.168.1.4
Host is up (0.0037s latency).
Nmap scan report for 192.168.1.5
Host is up (0.0062s latency).
Nmap scan report for 192.168.1.6
Host is up (0.0039s latency).
Nmap scan report for 192.168.1.7
Host is up (0.0039s latency).
Nmap scan report for 192.168.1.8
Host is up (0.0062s latency).
Nmap scan report for 192.168.1.9
Host is up (0.0026s latency).
Nmap scan report for 192.168.1.10
Host is up (0.0030s latency).
...
Nmap scan report for 192.168.1.250
Host is up (0.0029s latency).
Nmap scan report for 192.168.1.251
Host is up (0.0032s latency).
Nmap scan report for 192.168.1.252
Host is up (0.0025s latency).
Nmap scan report for 192.168.1.253
Host is up (0.0028s latency).
Nmap scan report for 192.168.1.254
Host is up (0.0039s latency).
Nmap done: 256 IP addresses (37 hosts up) scanned in 2.05 seconds
root@hostname:~$

3. According to the output above, there are only 37 hosts alive from 254 possible hosts. That is the end of the scanning process of all hosts in a specific network segment.

Leave a Reply