How to plan an authorized internal network scan

Why a plan prevents trouble

Even inside your own company, scanning can break things. Old printers reboot on unusual packets, building controllers fail on version probes, and security teams open incidents when they see a sweep they did not expect. A short written plan prevents all three by naming what will be scanned, how, when, and who to call.

It also protects you. If something fails during the window, the plan and saved output show exactly what you sent.

What goes in the plan

Keep it to one page. List in-scope ranges and excluded hosts, the scan source address, the exact commands, maximum packet rate, time window, the owner who approved it, the security operations contact who will expect it, and a stop condition such as “halt if any service owner reports an outage”.

Name fragile segments explicitly. Operational technology, medical devices, and lab equipment often need discovery-only scans or no scans at all.

• Scope ranges and exclude list file names
• Source host and address
• Exact Nmap commands and rates
• Start and end time, time zone
• Approver and SOC contact
• Stop conditions and rollback
• Where output is stored and for how long

Lab: write a plan and follow it

Write a plan for your home lab as if it were a company network: put your NAS and smart TV in the exclude list, cap the rate, and schedule a window. Then run exactly the commands in the plan with -oA, and compare what you ran to what you wrote. Any difference is a lesson about writing plans precisely.

Use the template below as a starting point and keep it in the same folder as the scan output.

SCAN PLAN  lab-2026-11-02
Scope:      192.168.56.0/24 (scope.txt)
Exclude:    192.168.56.1 gateway, 192.168.56.50 NAS (exclude.txt)
Source:     scanner VM 192.168.56.20
Commands:   nmap -sn -iL scope.txt --excludefile exclude.txt -oA disc
            nmap -sS -sV --top-ports 1000 -T3 --max-rate 300 -iL live.txt -oA svc
Window:     2026-11-02 19:00-21:00 UTC
Approved:   lab owner (me)
SOC notice: sent 2026-11-01
Stop if:    any device reboots or a service owner reports impact
Retention:  output deleted after 90 days

After the scan

Send a short note when the window closes: completed or stopped, anything unusual, and where results are. That closes the loop with the security team and builds trust for the next window.

Convert findings into tickets with owners. A plan that produces a scan but no fixes was a lot of packets for nothing.