VMware ESXi and vSphere Cluster Management

Discover Live Hosts with Nmap TCP SYN Ping Scans

Learn how Nmap TCP SYN ping scans discover reachable hosts when ICMP echo requests may be blocked, using -PS and -sn.

What Host Discovery Does

Host discovery is the process of identifying systems that appear reachable on a network. It is often performed before a port scan so you can focus later testing on systems that responded.

Host discovery answers a reachability question: Does this target appear to be online and reachable from the scanner? It does not answer which services are running or which ports are open. Those are questions for a subsequent service or port scan.

Why ICMP-Only Discovery Can Miss Hosts

Ordinary network ping commonly uses an ICMP Echo Request. A reachable host normally returns an ICMP Echo Reply, allowing the sender to measure reachability and latency.

However, firewalls, endpoint policies, routers, and other network devices may filter ICMP traffic. Some organizations block Echo Requests or Echo Replies even though they permit application traffic such as HTTPS. Therefore, an absent ICMP reply does not always prove that a host is offline.

A TCP-based discovery method provides another way to obtain evidence. If TCP traffic to a suitable port is allowed and the target responds, Nmap can identify the host even when ICMP discovery receives no reply.

How a TCP SYN Ping Works

A TCP SYN ping sends a TCP packet with the SYN flag set to one or more selected destination ports. The SYN flag is used by TCP to begin the connection process.

The response provides useful evidence:

  • SYN/ACK: The destination port is commonly listening, and the response shows that the host is reachable.
  • RST: A closed TCP port commonly returns a reset. Receiving that reset still demonstrates that the host responded, even though the service is not accepting connections on that port.
  • No response: The probe may have been filtered, lost, routed incorrectly, rate-limited, or sent to an offline host. No response is not a definitive statement about the host's state.

Nmap does not need the probed port to be open for discovery to succeed. A response from a closed port can be enough. Filtering is the important limitation: a firewall can suppress both the SYN/ACK and the RST.

Nmap Options for TCP SYN Host Discovery

Nmap is a network discovery and security-auditing tool. The -PS option selects TCP SYN ping probes, while -sn tells Nmap to perform host discovery without a normal port scan.

Option — Purpose — Example — Current usage note

-PS<ports> — Sends TCP SYN discovery probes to the specified port or ports — -PS21 or -PS22,80,443 — The option must be followed by a port number or port list.

-sn — Performs host discovery only and skips a normal port scan — nmap -sn -PS443 192.168.5.102 — Preferred current syntax for discovery-only scans.

-sP — Older ping-scan-only option — nmap -sP -PS21 192.168.5.102 — Legacy synonym encountered in older material; use -sn in current commands.

The target can be a single IPv4 or IPv6 address, a hostname, a CIDR network, or a target list. For example, 192.168.5.102 identifies one address, while 192.168.5.0/24 represents the addresses in an authorized subnet.

Basic TCP SYN Ping Examples

Probe One Host on TCP Port 21

Use this command to perform host-only discovery against one authorized host:

nmap -sn -PS21 192.168.5.102

Port 21 is commonly associated with FTP. If Nmap receives a qualifying TCP response, it reports the host as up. The command does not perform a normal scan of the host's ports.

Probe Several Common Ports Across a Subnet

Multiple probe ports can improve the chance of receiving a response when filtering differs by service:

nmap -sn -PS22,80,443 192.168.5.0/24

This sends TCP SYN discovery probes to ports 22, 80, and 443 for targets in the authorized subnet. These ports commonly correspond to SSH, HTTP, and HTTPS.

Use TCP Discovery When ICMP Is Uncertain

To test whether a host responds to HTTPS-related TCP traffic even when ICMP is blocked, use:

nmap -sn -PS443 192.168.5.102

If Nmap reports the host as up, the TCP response is evidence of reachability despite the ICMP nonresponse. Different firewall policies can apply to ICMP and TCP.

Recognize Legacy Syntax

Older Nmap examples may use:

nmap -sP -PS21 192.168.5.102

The modern equivalent is:

nmap -sn -PS21 192.168.5.102

-sP is useful to recognize when reading older documentation, but -sn is the preferred current option.

Choosing Probe Ports

Select ports that are likely to be permitted through the relevant firewall and likely to produce a response in the environment. The port does not have to be open: a returned RST from a closed port can still identify a reachable host. However, a filter may silently discard the probe or its response.

TCP port — Common service — Reason to consider it — Potential limitation

21 — FTP — Useful where FTP infrastructure is expected — Often filtered or absent in modern environments.

22 — SSH — Common administrative service on Unix-like systems and network appliances — May be restricted to management networks.

80 — HTTP — Frequently allowed for web servers and internal applications — A web server may redirect or protect traffic, and the port may be filtered.

443 — HTTPS — Commonly allowed through perimeter and internal firewalls — Some networks permit only selected source addresses or require a proxy.

Use several context-appropriate ports when one port gives uncertain results. Avoid choosing ports arbitrarily or sending excessive probes; discovery should remain within the authorized operational plan.

Interpreting Nmap Results

A discovery-only result commonly includes a statement that the host is up and may show measured latency. Latency is the observed time for communication between the scanner and the responding host.

Nmap scan report for 192.168.5.102
Host is up (0.012s latency).
Nmap done: 1 IP address (1 host up) scanned

This output indicates that Nmap received enough evidence to consider the host reachable. It does not list open services because -sn intentionally performs host discovery without a port scan.

Observed response — Likely meaning — What can be concluded about the host — Important caveat

SYN/ACK received — A TCP service commonly accepted the SYN — The host is reachable, and the probed port may be listening — The result is discovery evidence, not a complete service inventory.

RST received — The probed port is commonly closed — The host responded and is reachable — Other ports may have different filtering or service states.

No response — Filtering, packet loss, an unreachable route, or an offline target is possible — The host state is unresolved — Do not treat silence as definite proof that the host is down.

ICMP unreachable or filtering-related response — A device or host reported an unreachable condition, or filtering interfered — Some evidence exists about the path or policy, but the target's final state may remain uncertain — Interpret the message together with routing, firewall, and scan-position information.

A host discovered through TCP replies is alive from the scanner's point of view even if it does not answer ICMP. Conversely, a host reported as down may still be running if all selected discovery probes are blocked or lost.

Discovery Is Not Port Scanning

The command nmap -sn is designed to answer which targets appear reachable. It is not intended to enumerate all open ports or identify every service.

After host discovery, an authorized assessment may perform a separate service or port scan with a scope and method appropriate to the engagement. Keep the two phases conceptually separate:

  • Host discovery: Identifies systems that appear reachable.
  • Port scanning: Tests selected ports to determine whether they appear open, closed, or filtered.
  • Service assessment: May identify applications, versions, or protocol behavior on selected open ports.

Operational Limitations

Nmap may combine requested discovery methods with other default discovery probes unless the scan options explicitly control the behavior. Review the command and Nmap version documentation when you need a narrowly defined probe set.

Results can also depend on local privileges, operating system behavior, and network position. These factors affect whether Nmap can send and receive raw probes as intended. A scan launched from a different VLAN, through a firewall, or across a routed boundary may produce different results from one launched near the target.

Common causes of incomplete or misleading discovery include:

  • Firewalls and access-control lists silently dropping SYN packets or return traffic.
  • Intrusion detection or prevention systems altering, blocking, or rate-limiting probes.
  • Endpoint policies that reject or ignore unexpected traffic.
  • Asymmetric routing, where outbound and return traffic follow different paths.
  • Congestion, transient packet loss, or response rate limiting.
  • An invalid route or an unsuitable network vantage point.

When results are ambiguous, validate them with authorized alternative discovery methods or network-side evidence such as firewall logs, router records, endpoint administration data, or monitoring telemetry. Do not increase probing aggressively to compensate for uncertainty.

Troubleshooting Common Results

The Target Is Reported Down but Is Known to Be Running

Possible causes include a filtered probe port, a firewall or ACL silently dropping traffic, packet loss, rate limiting, or a missing route from the scanner to the target.

  1. Confirm that the target and the scan method are authorized.
  2. Try a small list of relevant ports such as 22,80,443, if appropriate to the environment.
  3. Check routing and firewall policies, including logs where available.
  4. Validate from an approved network vantage point or with another authorized discovery method.
  5. Record the result as uncertain rather than concluding that the host is offline.

ICMP Fails but TCP SYN Discovery Reports the Host Up

This commonly means ICMP Echo traffic is blocked while TCP traffic to the selected port is allowed or answered. Treat the TCP response as evidence of reachability and document that the two protocols are subject to different policies.

A Single TCP Probe Is Inconsistent

The selected port may be selectively filtered, network controls may treat service ports differently, or transient loss and response rate limiting may be present. Use a small, relevant list of authorized ports, repeat testing only as policy allows, and compare the result with network monitoring or endpoint administration data.

The Output Shows Only Host-Up Information

This is expected when -sn is present. The option intentionally limits Nmap to host discovery. Any later port or service assessment must be separately authorized and scoped.

Exam- and Practice-Relevant Notes

  • -PS means TCP SYN ping probes and must include a port number or list, such as -PS21 or -PS22,80,443.
  • -sn means host discovery only, without a normal port scan.
  • -sP is the older ping-scan-only syntax; prefer -sn today.
  • A SYN/ACK indicates a reachable host and commonly an open probed port.
  • An RST from a closed port can also prove that the host responded.
  • No response is ambiguous because filtering, loss, routing problems, or an offline target can produce the same observation.
  • ICMP nonresponse alone does not prove that a host is offline.
  • Host discovery results and open-port results are different kinds of findings.

For a related reference within this lesson, see Discover Hosts With A TCP Syn Ping Scan.