Before you scan
A discovery scan asks which hosts and ports answer. It is not a vulnerability exploit. It is still traffic on someone else’s network unless the written scope says otherwise.
Whose network
Name the owner. A friend, an employer, a school, and a previous client are not the same person, and none of them is you. If you cannot point at the person or the company that owns the addresses, you do not scan.
Your own lab is the easy case. The guest, the host-only network, and the snapshot you took are yours. A scanner pointed past that network is no longer a lab exercise.
The written scope
The scope names the addresses, the dates, and the people who may run the work. Silence is not a yes. A sentence in a chat is not a scope unless the owner of the network wrote it down as one.
Read that page before you open the tool. The scope lesson is the longer version. The scope desk is eight situations where you decide whether the work is allowed, needs a written change, or stops.
The time window
Write when the scan may start and when it must stop. A window that is “whenever” is how a scan lands in someone else’s incident. If the scope names business hours or a change window, stay inside it.
Put the start time in the same note as the output. A file with no time is hard to match to the permission that allowed it.
What you will not touch
List the addresses, the ports, and the kinds of work that are out. Production systems the scope does not name are out. Availability tests, password guessing, and anything that is not “which ports answer” are separate yes-or-no lines. If the paper is silent, the answer is no.
A discovery scan is a request for a list of ports that respond. It is not permission to try to break the service that answered.
Where the output goes
Decide the folder before you run anything. The output is a list of someone else’s hosts. Keep it with the engagement notes, not in a chat paste and not in a home directory you share. Delete it when the agreement says to.
The Nmap workbench is how to read that list after you have a file you were allowed to create. After a scan is how to write the list down without calling a port a vulnerability. The small-lab page is the isolated guest to practice on before anyone else’s network is in the scope.