Disable Host Discovery in Nmap with -Pn

Learn how Nmap host discovery works, why live hosts may appear down, and how to use -Pn to scan authorized targets without preliminary discovery.

When Nmap scans a target, it normally performs host discovery first. This preliminary step determines whether the target appears to be online before Nmap conducts a port scan or attempts optional service and operating-system detection.

Host discovery is often informally called a ping sweep. However, Nmap can use several probe types, not only ICMP echo requests. If the probes receive no suitable response, Nmap may classify the target as down and skip later scan operations.

Why a Live Host May Appear Down

A system can be online and reachable through a service port while ignoring Nmap's default discovery probes. Common causes include:

A firewall or packet filter blocks ICMP or other discovery traffic.
A security policy silently drops probes instead of sending responses.
Routing behavior prevents discovery packets or replies from reaching their destination.
The host permits traffic to a particular service port but does not respond to discovery methods used by the scan.

For example, a web server might accept TCP connections on port 80 while its firewall drops discovery probes. A normal scan could report that the host appears down even though the web service is reachable.

What -Pn Does

The current Nmap option for bypassing host discovery is -Pn. It tells Nmap to treat every supplied target as online and proceed with the requested scan operations.

nmap -Pn target

-Pn does not prove that a host is alive. It only bypasses Nmap's preliminary up-or-down decision. Nmap still has to receive useful responses from the requested port or other scan operation to produce meaningful results.

Default Discovery Compared with -Pn

Behavior	Default Nmap scan	Nmap scan with -Pn
Initial host-discovery step	Normally performed before the requested port scan.	Skipped.
Targets that do not answer probes	Usually classified as down and skipped for later scanning.	Treated as online for the requested scan.
Whether port scanning is attempted	Usually only for targets judged to be up.	Attempted for every supplied target.
Expected speed on a large address range	Often faster because apparently inactive targets can be skipped.	Potentially much slower because every listed address is scanned.
Best use case	Normal discovery and scanning of a reasonably responsive network.	A known, authorized target whose discovery responses may be blocked.

Scan a Specific Port Range with -Pn

The -p option selects ports for the port scan. The following command skips discovery and scans TCP ports 50 through 90 on one target:

nmap -Pn -p 50-90 192.168.5.102

Here, -Pn disables host discovery, -p 50-90 selects the port range, and 192.168.5.102 is the target IP address. The example is deliberately limited to one address and a narrow range.

To test one web-service port:

nmap -Pn -p 80 192.168.5.102

Compare the normal behavior with the disabled-discovery behavior:

nmap -p 80 192.168.5.102
nmap -Pn -p 80 192.168.5.102

The first command may stop early if Nmap considers the target down. The second attempts the port scan regardless of the discovery result. If the second command produces no useful result, the target could still be offline, unreachable, or protected by filtering.

Understanding Port States in a -Pn Scan

Skipping host discovery does not change the meaning of the port states reported by the port scan.

State	Meaning	What it suggests when host discovery was skipped
open	An application is accepting connections or otherwise responding as available.	The target responded in a way that indicates the selected port is available.
closed	The port is reachable, but no application is accepting connections there.	The target or its network path responded, even though that particular port has no listening service.
filtered	Filtering prevents Nmap from determining whether the port is open or closed.	A firewall, packet filter, unreachable path, or offline host may be preventing a decisive response.

See Nmap port states and how to interpret scan results for more detail.

Service and Operating-System Detection

Options for service version detection or operating-system detection have requirements beyond simply assuming that a target is online. With -Pn, Nmap attempts those operations according to their own scan requirements, but the quality of the result depends on receiving suitable responses from the target.

For example, -Pn does not guarantee that version detection will identify a service, nor that OS detection will produce a confident match. A filtered path or an unresponsive host can still prevent those results. Related topics include service version detection and operating-system detection.

Performance and Scope Considerations

With normal discovery, Nmap can avoid deeper scanning of targets that appear inactive. With -Pn, Nmap scans every supplied target as though it were online.

A scan across a large address range can take substantially longer.
Unused, unreachable, or filtered addresses may generate repeated scan traffic and timeouts.
A broad -Pn scan can create unnecessary traffic and make results harder to review.
Restrict the target list and port selection whenever possible.

Use -Pn against known, authorized systems rather than automatically applying it to a large network range. For target selection, see specifying an IP address range and specifying port ranges.

Historical Spelling: -PN

Older Nmap documentation and releases used the uppercase spelling -PN for this behavior. Current Nmap uses lowercase -Pn, which should be preferred on modern installations.

If you are working with an older or unusual installation, check its local option list:

nmap --help

The help output and installed version identify the syntax supported by that copy of Nmap. Do not assume that an older command example uses the preferred spelling for a current release.

Troubleshooting

Nmap says the host appears down

Possible causes: discovery probes are blocked or ignored, the host is offline, or routing and firewall policy prevents a response.
Response: for a known authorized target, retry a narrowly scoped scan with -Pn and evaluate the actual port results.

The -Pn scan takes too long

Possible causes: Nmap is attempting operations against every listed address, including unused or unreachable addresses, or the port selection is too broad.
Response: reduce the target scope, limit the port range, and avoid using -Pn across large ranges unless it is necessary and authorized.

Only filtered ports or no actionable results appear

Possible causes: a firewall is dropping scan traffic, the host is offline or unreachable, or the selected scan type does not fit the network path.
Response: verify authorization, target addressing, network reachability, and firewall policy. Do not interpret -Pn itself as evidence that the host is alive.

-PN is not recognized

Likely cause: the installed Nmap version expects the modern lowercase option.
Response: use -Pn and consult nmap --help for version-specific syntax.

Key Points

Nmap normally performs host discovery before port scanning.
A host can be reachable on a service port while blocking discovery probes.
-Pn skips the preliminary up-or-down decision and treats each supplied target as online.
-Pn does not demonstrate that a target is reachable.
Use narrow, authorized target scopes because -Pn can make large scans slower and noisier.
The legacy spelling is -PN; current Nmap syntax is -Pn.

For broader context, review how Nmap discovers whether a host is online, TCP SYN ping host discovery, and what Nmap is.