Discover Live Hosts with an Nmap TCP SYN Ping Scan
Learn how Nmap TCP SYN host discovery uses -PS and -sn to identify reachable hosts when ICMP ping may be blocked or filtered.
Host discovery is the process of determining which IP addresses appear reachable before performing deeper scanning. An Nmap TCP SYN ping scan is useful when ICMP Echo Requests are blocked or ignored by firewalls and host policies.
This lesson explains how -PS TCP SYN probes work with -sn host discovery, how to choose probe ports, how to interpret responses, and how to validate negative results. Scan only systems and networks that you own or are explicitly authorized to assess.
What Host Discovery Does
Host discovery answers a limited question: does this target appear reachable? It does not identify every service or determine which ports are open.
- Host discovery: identifies IP addresses that appear online or reachable.
- Port enumeration: tests TCP or UDP ports to determine their states.
- Service enumeration: investigates an open port to identify the service, application, or version behind it.
Scanning only hosts that respond to discovery can reduce scan time and unnecessary traffic, especially when a network range contains many unused addresses. However, a host that does not respond is not automatically offline; filtering can hide a live system.
For background, review how to discover if a host is online and the basics of IP addresses.
Why ICMP Ping Can Be Unreliable
An ICMP Echo Request is the message commonly used by the traditional ping utility. Firewalls, routers, and host security policies may block, rate-limit, or silently ignore these requests. Therefore, the absence of an ICMP Echo Reply does not prove that a target is offline.
TCP-based discovery provides another reachability test. Instead of asking the host to answer an ICMP message, Nmap sends a TCP SYN packet to a selected destination port. The response, if any, can provide evidence that the IP host is reachable.
How a TCP SYN Ping Works
A TCP SYN is a TCP packet flag used to begin a connection handshake. In host discovery, Nmap sends a SYN probe but does not complete a normal TCP connection.
- Nmap sends a TCP SYN packet to one or more specified ports.
- If the port is open, the target will generally answer with SYN/ACK.
- If the port is closed but reachable, the target can answer with RST, or reset.
- Nmap interprets these responses as evidence that the host is up.
- Nmap does not proceed through the full handshake for this discovery probe.
| Observed response | Likely port condition | Host reachability conclusion | Important caveat |
|---|---|---|---|
| SYN/ACK | The probed port is likely open | The host is generally reachable | The discovery run is not a complete connection or service scan. |
| RST | The probed port is likely closed | The host is reachable | A closed port can still provide a useful live-host response. |
| No response | The port may be filtered, or packets may be lost | Inconclusive | The host may be online but blocked by a firewall, ACL, route problem, or rate limit. |
| ICMP unreachable or administratively prohibited | A device or policy rejected or blocked the traffic | There may be a reachable filtering device, but the target's state is uncertain | Interpret the message in the context of routing, segmentation, and firewall policy. |
A filtered condition means that packets or replies are blocked, suppressed, or otherwise unavailable for reliable interpretation. Stateful firewalls may treat unsolicited SYN packets differently from packets belonging to an established connection.
The Nmap Options
| Option | Purpose | Current or legacy status | Example |
|---|---|---|---|
-PS<ports> | Sends TCP SYN host-discovery probes to one or more TCP ports. | Current option | -PS21 or -PS22,80,443 |
-sn | Performs host discovery without a port scan. | Current option | nmap -sn -PS21 192.168.5.102 |
-sP | Older ping-scan-only syntax. | Legacy; use -sn in current commands | nmap -sP -PS21 192.168.5.102 |
-oN | Saves normal, human-readable output to a file. | Current output option | -oN syn-host-discovery.txt |
The -PS option requires one or more TCP port numbers. Supply one port directly or separate several ports with commas. The -sn option is important because it tells Nmap to perform discovery only rather than continue into ordinary port scanning.
Basic TCP SYN Discovery Commands
One target and one probe port
nmap -sn -PS21 192.168.5.102This sends a TCP SYN probe to port 21 on the authorized target. A SYN/ACK or RST can cause Nmap to report the host as up. The command does not conduct a normal port scan.
Several probe ports across a subnet
nmap -sn -PS22,80,443 192.168.5.0/24Multiple ports increase the chance that at least one probe receives a meaningful response. Results still depend on firewall, routing, and host policy. Use this only against an authorized subnet.
Save the results
nmap -sn -PS80,443 -oN syn-host-discovery.txt 192.168.5.0/24Normal output logging preserves the discovery results for review before an authorized follow-up assessment. You can also read about saving Nmap output.
Recognize older syntax
nmap -sP -PS21 192.168.5.102Older Nmap material may use -sP for ping-scan-only behavior. The current equivalent is:
nmap -sn -PS21 192.168.5.102Choosing TCP Probe Ports
Select ports that network policy is likely to permit or that hosts in the environment commonly use. The numbers below are illustrative, not assumptions about a particular network.
| Probe port example | Typical association | Why it may be selected | Reason it may fail |
|---|---|---|---|
| 21 | FTP | Useful when FTP is present or permitted in the environment. | The port may be filtered, unused, or blocked by policy. |
| 22 | SSH | Common on Unix-like systems and administrative infrastructure. | SSH may be restricted to management networks. |
| 80 | HTTP | Often permitted where internal or public web services exist. | Web traffic may be redirected, filtered, or unavailable. |
| 443 | HTTPS | Frequently allowed through enterprise firewalls. | HTTPS may be limited to selected segments or gateways. |
| Environment-specific ports | Applications used by the organization | Reflects local firewall rules and common services more accurately. | A port-specific ACL can still silently drop the probe. |
A closed but reachable port can return RST and therefore identify a live host. Conversely, choosing a port that is filtered can make a live host appear unavailable. Use knowledge of the authorized environment to select ports, rather than assuming that every host runs the services commonly associated with these numbers.
Reading Nmap Output
A successful discovery-only result commonly contains a line such as:
Nmap scan report for 192.168.5.102
Host is up (0.012s latency).Host is up means Nmap received a response or other evidence that the address is reachable. The latency value, such as 0.012s, is the observed response time between the scanner and the responding host. It can vary with network load and routing.
Because -sn requests host discovery only, the output does not list open ports. A host-up finding and an open-port finding answer different questions. If a host responds with RST, it may be reported as up even though the selected probe port is closed.
If no target responds, Nmap may finish with a summary indicating that no hosts appear to be up. Treat this as a negative discovery result, not proof that every address is offline. Confirm the target range, routing, segmentation, and applicable filtering policy.
For more help reading results, see interpreting Nmap scan results and using Nmap's reason information.
Privileges and Packet Handling
Raw TCP SYN probing commonly requires elevated privileges or appropriate raw-socket and packet-capture capabilities. Behavior varies by operating system and by how Nmap was installed. Without the needed capabilities, Nmap may use a different probing mechanism, provide reduced functionality, or fail to behave as expected.
Run Nmap with the authorized privileges required by the local platform, and consult the local Nmap documentation for platform-specific behavior. Do not bypass organizational controls or scan targets outside the approved scope.
Operational Limitations
- Stateful firewalls: may drop unsolicited SYN packets or allow them only from particular source networks.
- ACLs: may permit some probe ports while blocking others.
- IDS and IPS controls: may detect, rate-limit, or suppress scanning traffic.
- NAT: can hide the actual host or cause responses to come from a gateway.
- Asymmetric routing: can send replies along a path the scanner cannot observe.
- Packet loss and rate limiting: can cause intermittent or incomplete results.
- Offline or incorrectly addressed systems: naturally produce no useful response.
A negative result is especially uncertain when filtering is possible. Validate findings against network knowledge and, where authorized, compare them with other discovery methods such as ICMP discovery or TCP ACK discovery using -PA. On a local Ethernet network, ARP-based discovery may provide stronger evidence for systems on the same Layer 2 segment.
Troubleshooting
A known host is not reported as up
- The selected SYN port may be filtered.
- A firewall may silently drop the SYN or return traffic.
- The target may be reachable only through another route, interface, VLAN, or VPN.
- Packet loss or rate limiting may affect the probes.
- The target address may be wrong, or the host may be offline.
First verify authorization, the target address, local connectivity, and routing. Try several probe ports appropriate to the environment, then compare the result with an authorized ICMP or TCP ACK discovery method. Review firewall and ACL policy when access is available.
The host is up, but the selected port is not shown as open
This is expected for two reasons. The target may have returned RST, proving reachability while indicating that the probed port is closed. Also, -sn performs discovery only and does not enumerate ports. If an open-port inventory is authorized and required, schedule a separately scoped port scan after discovery.
The command behaves unexpectedly without administrator privileges
The operating system or Nmap installation may restrict raw packet operations. Run with the required authorized privileges or capabilities and check platform-specific Nmap guidance.
Every host in a subnet appears down
Possible causes include blocked probe ports, the wrong VLAN or VPN, incorrect routing, or a gateway that blocks outbound probes or inbound responses. Test a known reachable system, validate connectivity, choose ports relevant to the environment, and compare the result with approved alternative discovery probes.
Exam-Relevant Summary
- Host discovery finds reachable hosts; it is distinct from port and service enumeration.
- ICMP Echo Requests can be blocked, so no ICMP reply does not necessarily mean that a host is offline.
-PSsends TCP SYN probes to specified ports.- A SYN/ACK usually indicates an open port and a reachable host.
- An RST usually indicates a closed port but still demonstrates host reachability.
- No response is inconclusive because filtering, routing problems, loss, and an offline host can look similar.
-snis the current host-discovery-only option;-sPis legacy syntax.- Use multiple environment-appropriate probe ports, and interpret results within the network's firewall and routing context.
- Raw SYN probing may require elevated privileges.