How Nmap host discovery works: ping scans, ARP, and -Pn

What Nmap sends before it scans ports

Before scanning ports, Nmap asks whether each address is alive. On a local Ethernet or Wi-Fi subnet, a privileged scan uses ARP requests, because a host must answer ARP to talk on the segment at all, and firewalls rarely block it. On a routed network, the default discovery set is an ICMP echo request, a TCP SYN to port 443, a TCP ACK to port 80, and an ICMP timestamp request.

An unprivileged user cannot send raw ICMP or ARP, so Nmap instead tries TCP connections to ports 80 and 443 and treats any reply, even a refusal, as proof of life. That is why unprivileged sweeps miss hosts more often.

Ping scan only with -sn

The -sn option means “discover hosts and stop”. It is the right first pass on a lab subnet: you get a list of live addresses, MAC addresses and vendor names on a local segment, and latency, without touching a single service port. It is also quick enough to run on a schedule as a cheap asset inventory.

Add --traceroute or -R for reverse DNS when you want context, or -n to skip DNS entirely when the resolver is slow or when you do not want lookups leaving the lab.

Snippet

sudo nmap -sn 192.168.56.0/24
sudo nmap -sn -n 192.168.56.0/24 -oG - | awk '/Up$/{print $2}'

When to skip discovery with -Pn

Some hosts drop every discovery probe but still run services, for example a Windows machine with the default firewall profile that blocks ICMP echo. Nmap then reports “Host seems down” and scans nothing. -Pn tells Nmap to treat every target as up and go straight to port scanning.

The cost is time. Against a /24 where only ten hosts exist, -Pn makes Nmap probe ports on 254 addresses and wait for timeouts on most of them. Use -Pn on single hosts you know exist, or after a discovery pass, not as a habit on large ranges.

Lab: compare discovery methods on your subnet

Run three discovery passes on the host-only network: a privileged -sn, an unprivileged -sn, and a privileged pass with --disable-arp-ping and -PE so only ICMP echo is used. Count the hosts each finds. Then enable the Windows firewall’s default inbound rules on a Windows VM and repeat.

You should see ARP find every VM, ICMP-only miss the Windows host, and the unprivileged pass find only hosts with ports 80 or 443 reachable. Write down which method found which hosts. That table is the reason inventories built from ping sweeps should say how they were built.

Snippet

sudo nmap -sn 192.168.56.0/24
nmap -sn 192.168.56.0/24
sudo nmap -sn --disable-arp-ping -PE 192.168.56.0/24

Diagram

Which discovery probe answers on which network

The same -sn command sends different packets depending on privileges and where the target sits.

Local subnet, root
ARP request. Near-certain answer from any host on the segment.
Routed network, root
ICMP echo, TCP SYN 443, TCP ACK 80, ICMP timestamp. Any reply counts.
Unprivileged
TCP connect attempts to 80 and 443. Hosts with those ports filtered can look down.
-Pn
No discovery at all. Every address is treated as up and port-scanned.

Check yourself

1. Running sudo nmap -sn on your own Wi-Fi subnet, what does Nmap primarily use to find hosts?

2. What does -Pn change?

3. A Windows VM runs a web server but an ICMP-only sweep marks it down. Why?