Reconnaissance Techniques · Topic 5 of 8
Scanning Concepts, Host and Port Discovery
Learn network scanning for the CEH exam: TCP flags, ping sweeps, Nmap host discovery and port scan types, port states and common scanning tools.
- 6 min
- Includes a diagram
- The SYN scan is -sS, the connect scan is -sT, and UDP is -sU.
- Null, FIN and Xmas: closed returns RST, open returns nothing.
- ACK scans map firewalls, and idle scans use a zombie host.
What it is
Network scanning is the second phase. It sends probes to the address ranges found in footprinting to learn which hosts are alive, which ports are open and which services answer.
Scanning is active. It generates traffic that an intrusion detection system can log, so authorization matters.
How it works
TCP basics for scanning
A TCP connection starts with a three-way handshake: SYN, then SYN/ACK, then ACK. Many scan types are variations that stop early or send unusual flag combinations.
| Flag | Meaning |
|---|---|
| SYN | Start a connection |
| ACK | Acknowledge received data |
| FIN | Close a connection politely |
| RST | Reset, refuse or abort a connection |
| PSH | Push data to the application now |
| URG | The data is urgent |
Scanning tools
| Tool | Notes |
|---|---|
| Nmap (and Zenmap, its graphical front end) | The standard scanner for hosts, ports, services and OS |
| Hping3 | Crafts custom packets, useful for firewall testing |
| Masscan | Very fast scanner for large address ranges |
| Angry IP Scanner | Simple graphical ping and port scanner |
| NetScanTools Pro | Windows toolkit with many network utilities |
| Metasploit auxiliary scanners | Scanning modules inside the framework |
Host discovery
Host discovery decides which addresses to scan further. Nmap sends different probes depending on the options.
| Technique | Nmap option | Idea |
|---|---|---|
| ICMP echo ping | -PE | Echo request, a reply means the host is up |
| ICMP timestamp or address mask ping | -PP, -PM | Alternative ICMP types when echo is blocked |
| ARP ping | -PR | Works on the local network and is hard to block |
| TCP SYN ping | -PS | Sends SYN to a port, either SYN/ACK or RST proves the host is up |
| TCP ACK ping | -PA | Sends ACK, an RST reply shows a live host |
| UDP ping | -PU | Sends UDP, a port unreachable reply shows a live host |
| IP protocol ping | -PO | Tries other IP protocols |
| Ping scan only | -sn | Host discovery without a port scan |
| Skip discovery | -Pn | Treat all hosts as up and scan them anyway |
A ping sweep sends echo requests to a whole range. Hosts that block ICMP will not answer, which is why ARP, TCP and UDP probes are also used.
Port and service discovery
Ports are 16 bit numbers, from 0 to 65535. Well-known ports are 0 to 1023, registered ports are 1024 to 49151, and dynamic ports are 49152 to 65535.
| Scan type | Nmap option | Behavior | Result for open port |
|---|---|---|---|
| TCP connect | -sT | Full handshake through the operating system | Connection completes |
| SYN (half-open, stealth) | -sS | SYN, then RST instead of ACK | SYN/ACK received |
| Null | -sN | No flags set | No response |
| FIN | -sF | Only FIN set | No response |
| Xmas | -sX | FIN, PSH and URG set | No response |
| ACK | -sA | Only ACK set | Maps firewall rules, does not find open ports |
| Window | -sW | ACK scan that reads the TCP window field | Open or closed from window size |
| Idle | -sI | Uses a zombie host with predictable IP ID | Spoofs scan through the zombie |
| UDP | -sU | UDP datagrams | Often no response |
| SCTP INIT | -sY | SCTP version of a SYN scan | INIT-ACK received |
For null, FIN and Xmas scans, a closed port returns RST and an open port stays silent. These work against systems that follow the TCP specification, and they often fail against Windows hosts, which tend to send RST for both open and closed ports.
For an ACK scan, an RST reply means the port is unfiltered, and no reply or an ICMP unreachable means a firewall is filtering.
For a UDP scan, an ICMP port unreachable message means closed. No response means open or filtered, so UDP scans are slow and uncertain.
Port states in Nmap
| State | Meaning |
|---|---|
| open | An application accepts connections |
| closed | Reachable but nothing listens |
| filtered | A firewall or filter blocks the probe, so the state is unknown |
| unfiltered | Reachable but open or closed is not determined (ACK scan) |
| open or filtered | Cannot tell, typical for UDP, null, FIN and Xmas |
| closed or filtered | Cannot tell, used by the idle scan |
Service version detection
Service discovery learns which program listens on a port and its version. In Nmap, -sV probes the open ports and compares the answers with a database. -A turns on OS detection, version detection, script scanning and traceroute together. The Nmap Scripting Engine (NSE) runs scripts for deeper checks. Timing templates -T0 to -T5 (paranoid, sneaky, polite, normal, aggressive, insane) trade speed for stealth.
By default Nmap scans the 1000 most common ports. The -p option picks ports, -p- covers all 65535, and -F scans fewer ports than the default.
A worked example
A tester sweeps a /24 network with an ARP ping, gets 14 live hosts, and then runs a SYN scan on all of them. One host shows port 443 as open and port 8080 as filtered. A version scan of the open port shows an old web server release, which becomes a finding for the report.
How the exam asks about this
- "Which scan sends SYN and then RST, so no full connection is made?" -> SYN (half-open or stealth) scan, -sS.
- "A scan sets FIN, PSH and URG. What is it?" -> An Xmas scan.
- "Which scan identifies firewall rules rather than open ports?" -> The ACK scan.
What to remember for the exam
- The SYN scan is -sS, the connect scan is -sT, and UDP is -sU.
- Null, FIN and Xmas: closed returns RST, open returns nothing.
- ACK scans map firewalls, and idle scans use a zombie host.
- Filtered means a firewall blocks the probe.
- -Pn skips host discovery, and -sn only does discovery.
Null, FIN and Xmas scans do not work reliably against Windows systems, so a question about unreliable results on Windows points to those scans.
Common mistakes
Calling the SYN scan "stealthy" without qualification. Modern intrusion detection systems log it. The name only means no full connection.
Reading no response as closed. For UDP and for flag-based scans it can mean open or filtered.
Mixing up -sn and -Pn. The first does discovery only. The second skips discovery.
Check yourself
What does a SYN/ACK reply to a SYN scan show?
That the port is open.
What does the Nmap option -Pn do?
It skips host discovery and scans the target as if it were up.
What does an ICMP port unreachable reply to a UDP probe mean?
The UDP port is closed.
Topic 5 of 8 in Reconnaissance Techniques
Test yourself on Reconnaissance Techniques
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.