Nmap Host Discovery Visualizer

Interactive visualization of Nmap host discovery techniques and options

Packet Flow Animation

Visualize how different discovery probes interact with firewalls and reach target hosts.

📡

Scanner

🛡️

Firewall

🖥️

Target

How it works: Click a probe type to see how the packet travels. The firewall may allow it (green), block it (red), or send a spoofed RST (orange). If the packet reaches the target, you'll see the response and final result.

Traceroute Animation

Watch how traceroute discovers the network path by incrementing TTL values.

📡

Scanner

🔀

R1

🔀

R2

🔀

R3

🖥️

Target

How it works: Traceroute starts with TTL=1. The first router decrements it to 0, drops the packet, and sends an ICMP Time Exceeded. This continues until the target is reached, revealing the complete network path.

Discovery Options

Basic Discovery Modes

-sL (List Scan)

Lists each host without sending any packets. Performs reverse-DNS resolution by default.

-sn (No Port Scan / Ping Scan)

Performs host discovery only, no port scanning. Uses default probes: ICMP echo, TCP SYN to 443, TCP ACK to 80, ICMP timestamp.

-Pn (No Ping / Skip Host Discovery)

Skips host discovery entirely. Scans all specified IP addresses regardless of whether they appear to be up.

UDP & SCTP Ping Options

-PU (UDP Ping)

Sends UDP packets. Elicits ICMP port unreachable from closed ports. Default port is 40125.

Port(s) (e.g., 53, 161, 40125):

-PY (SCTP INIT Ping)

Sends SCTP INIT chunks. Default port is 80. Requires root privileges.

Port(s) (e.g., 80, 5060):

IP Protocol Ping

-PO (IP Protocol Ping)

Sends IP packets with specified protocol numbers. Default: ICMP (1), IGMP (2), IP-in-IP (4).

Protocol(s) (e.g., 1, 2, 4 or 1,6,17):

Advanced Options

--disable-arp-ping

Disables ARP/Neighbor Discovery for local ethernet hosts. Useful on networks using proxy ARP.

--discovery-ignore-rst

Ignores TCP RST replies during host discovery. Prevents false positives from firewalls spoofing RST packets.

--traceroute

Performs traceroute to each host after scanning. Uses dynamic timing and parallel execution.

Generated Command

nmap target

About Host Discovery

Host discovery is the first step in network reconnaissance, reducing large IP ranges into a list of active hosts. By default, Nmap sends an ICMP echo request, TCP SYN to port 443, TCP ACK to port 80, and an ICMP timestamp request. You can combine multiple probe types to maximize chances of bypassing firewalls. ARP/Neighbor Discovery is done automatically for local ethernet networks unless disabled.

TCP Ping Options

-PS (TCP SYN Ping)

Sends TCP SYN packets. Default port is 80. Can bypass firewalls that block ICMP.

Port(s) (e.g., 80, 443, 22-25,80,443):

-PA (TCP ACK Ping)

Sends TCP ACK packets. Useful for bypassing stateless firewalls that block SYN packets.

Port(s) (e.g., 80, 443, 22-25,80,443):

ICMP Ping Options

-PE (ICMP Echo Request)

Standard ICMP type 8 (echo request) ping. Many firewalls block this.

-PP (ICMP Timestamp Request)

ICMP timestamp request (code 13). Useful when echo requests are blocked.

-PM (ICMP Address Mask Request)

ICMP address mask request (code 17). Another alternative when echo requests are blocked.

Active Probes Visualization

Default Probes: When no specific discovery options are selected, Nmap uses: ICMP echo request (-PE), TCP SYN to port 443 (-PS443), TCP ACK to port 80 (-PA80), and ICMP timestamp request (-PP).