Nmap online course

Discover Whether Hosts Are Online with Nmap Host Discovery

Learn how to use Nmap -sn to discover responsive hosts on a single IP address or CIDR network without performing a port scan.

Host discovery is the Nmap phase used to determine whether target systems appear reachable before port scanning. This lesson shows how to check one authorized host and how to identify responsive systems across an IPv4 network using Nmap's -sn option.

Host Discovery Versus Port Scanning

Determining whether a host appears reachable is different from checking which network services are exposed. Host discovery uses probes and responses to identify active or apparently reachable systems. A port scan sends probes to selected TCP or UDP ports to determine their states and, in some cases, identify services.

Host discovery is therefore a fast preliminary step. For example, an administrator might first find responsive systems in an authorized subnet and then decide whether a separately authorized port scan is appropriate. Omitting port enumeration is the main reason a discovery-only scan is usually faster than a full scan.

Use -sn for Discovery Only

The Nmap -sn option selects host-discovery-only mode. Nmap performs its discovery probes and then skips the port-scanning phase.

nmap -sn <target>

A target can be a host address, hostname, address range, or network written in CIDR notation. When a target responds to an appropriate discovery probe, Nmap generally reports it as Host is up. The output may also include latency, which is the observed response time between the scanner and the responding target.

The informal term ping scan is often used for this operation. It does not mean that Nmap is limited to the operating system's ping command or to ICMP echo requests. Nmap can use different discovery mechanisms depending on the target and network context.

Scan One Authorized IPv4 Host

Use a private IPv4 address for a lab or network you are authorized to administer:

nmap -sn 192.168.5.102

An illustrative result might look like this:

Starting Nmap 7.95 ( https://nmap.org )
Nmap scan report for 192.168.5.102
Host is up (0.0030s latency).
Nmap done: 1 IP address (1 host up) scanned in 0.04 seconds

Interpret the Output

• Scan report: The line beginning with Nmap scan report for identifies the target that Nmap evaluated.
• Host status: Host is up means that Nmap received a response indicating that the target appears reachable.
• Latency: The value in parentheses is the observed response time. It is a measurement for this scan, not a permanent property of the host.
• Number of targets: The final line states how many IP addresses Nmap considered and how many were reported as up. Here, one address was scanned and one host was up.
• Elapsed scan time: The final time value shows how long Nmap took to complete this operation on the local system and network.

Because -sn disables port scanning, this output does not identify open ports or services. The speed benefit comes from omitting port enumeration.

Scan an IPv4 Network with CIDR Notation

CIDR notation combines a network address with a prefix length, such as 192.168.5.0/24. The prefix length indicates how many leading bits identify the network. A /24 IPv4 network has 24 network bits and 8 host bits, representing 256 address values in the block.

In an ordinary IPv4 subnet, the first address is commonly reserved as the network address and the last is commonly used as the broadcast address. Their practical treatment can vary with the scan context, operating system, and network behavior, so do not assume that every address in the 256-value block is an ordinary host address.

nmap -sn 192.168.5.0/24

This command gives Nmap a network-sized target rather than one host-sized target. Nmap evaluates addresses in the specified range and reports the systems that respond to its discovery probes. A typical summary could resemble:

Nmap scan report for 192.168.5.1
Host is up (0.0021s latency).
Nmap scan report for 192.168.5.102
Host is up (0.0030s latency).
Nmap done: 256 IP addresses (2 hosts up) scanned in 1.84 seconds

How to Interpret Discovery Results

Why Ordinary Ping Discovery Can Miss Hosts

An ICMP echo request is a common reachability probe associated with the ping utility. Administrators and firewalls can block, drop, or ignore these requests. This behavior is called ICMP filtering.

Consequently, a missing ICMP reply is not conclusive proof that a host is offline. Discovery results depend on routing, local network conditions, packet loss, firewall policy, target configuration, and the probe types selected by Nmap. A host may be operating normally while intentionally refusing to answer ICMP echo requests.

If an authorized host is known to exist but does not appear in a basic discovery scan, a possible follow-up is TCP SYN ping. This method sends a TCP SYN probe to assess reachability through TCP. It can be useful when ICMP responses are unavailable or unreliable, but it is still subject to filtering and must be used within the approved scope.

See Discover Hosts with a TCP SYN Ping Scan for that alternative technique. For background on addresses, review IP addresses and private IP addresses.

Troubleshoot Missing or Slow Results

A Known Host Is Not Reported as Up

• ICMP echo requests or other default discovery probes may be filtered.
• The target may be offline, disconnected, asleep, or reachable through a different network path.
• A firewall, router, VPN configuration, or network ACL may block probes or replies.
• The specified address or CIDR range may be incorrect.

First verify the target address and authorized scope. Confirm basic network connectivity and routing. If the host is known to be present, use an appropriate alternate method such as TCP SYN host discovery where permitted. Do not interpret silence alone as proof of absence.

A Network Range Scan Takes Longer Than Expected

• The range may contain many addresses.
• Unresponsive or filtered addresses can require timeout handling.
• Latency, packet loss, or filtering can delay responses.

Reduce the scope while testing, validate the CIDR prefix, and account for inactive or filtered addresses. A /24 can contain 256 address values, so it naturally requires more work than checking one host.

You Expected -sn to Show Open Ports

This is a confusion between host discovery and port scanning. The -sn option intentionally skips the port scan. If port information is required, perform a separately authorized port scan and interpret its results independently. The Nmap port states lesson explains common port results.

Safe, Narrow, and Deliberate Scanning

1. Confirm written or clearly defined authorization and the exact address scope.
2. Start with one private lab host, such as 192.168.5.102.
3. Use -sn to avoid unnecessary port enumeration during the initial inventory step.
4. Expand to a network range only after verifying the CIDR notation, for example 192.168.5.0/24.
5. Review traffic volume, monitoring requirements, and the possibility of alerts before scanning a broader range.

Key Takeaways

• Host discovery identifies systems that appear reachable; port scanning investigates port states.
• nmap -sn <target> performs discovery while skipping the port-scanning phase.
• A single IP checks one target, while CIDR notation such as 192.168.5.0/24 specifies a network-sized range.
• Latency is the observed response time, and the summary reports how many target addresses were scanned and how many hosts were up.
• ICMP filtering and other network conditions can make a live host appear silent.
• Use alternate methods such as TCP SYN ping only when authorized and appropriate.