Introduction
Welcome to the Host Discovery Strategies lab!
Before a security professional or network administrator can analyze the vulnerabilities of a system, they must first know which systems are actually online and responding. This process is known as "Host Discovery" or "Ping Sweeping."
Host discovery is about presence, not exposure. At this stage you are asking "which addresses appear alive?" rather than "which services are vulnerable?" Keeping those questions separate makes scanning more controlled and less noisy.
In this lab, you will learn how to map the perimeter of a target network using Nmap, the industry-standard network scanning tool. You will practice executing various host discovery techniques, including disabling aggressive port scans, performing stealthy ARP pings, and executing ICMP sweeps to discover live hosts efficiently.
Disable Port Scanning (-sn)
In this step, you will learn the most fundamental concept of host discovery: telling Nmap to only look for live hosts and skip the port scanning phase.
By default, when you give Nmap an IP address, it will first check if the host is alive, and if it is, Nmap will automatically proceed to scan its ports (usually the top 1000 common ports). While port scanning is useful, it is noisy, time-consuming, and easily detected by firewalls and Intrusion Detection Systems (IDS).
Separating discovery from enumeration is a common professional workflow. First find live hosts. Then decide which of those hosts deserve deeper probing.
When your goal is simply to map out a network and find out which IP addresses are active, you should disable port scanning. You can do this using the -sn flag (which stands for "Ping Scan" or "No port scan").
Let's run a basic host discovery scan against your local machine so the example works reliably inside the lab environment. Ensure you are in your default working directory ~/project.
Execute the following command in your terminal:
nmap -sn 127.0.0.1
You should see an output similar to this:
Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-25 10:00 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.02 seconds
Notice that the output only tells you that the "Host is up" and provides the latency. It does not list any open or closed ports, making the scan much faster and stealthier.
Perform an ARP Ping Scan
In this step, you will learn how to perform an ARP (Address Resolution Protocol) Ping scan.
When you are scanning a local network (devices connected to the same router or switch as you), the most efficient and reliable way to discover hosts is by using ARP. ARP operates at Layer 2 (the Data Link layer) of the OSI model. It asks the network, "Who has this IP address? Please send me your MAC address."
This works well because ARP is fundamental to local communication. A device may ignore pings, but it still needs ARP to participate on the local network.
Because ARP is essential for local network communication, firewalls rarely block it. This makes ARP pinging incredibly accurate for local host discovery. Nmap uses the -PR flag to specify an ARP ping.
Note: ARP requests cannot be routed across the internet. Therefore, we must test this against a local address. In a real scenario, you would scan your local subnet like 192.168.1.0/24.
Note that crafting raw network packets (like custom ARP requests) requires administrative privileges, so you must use sudo with this command.
Run the following command to perform an ARP ping against your local machine:
sudo nmap -sn -PR 127.0.0.1
The output will look similar to this, prioritizing ARP requests under the hood to determine if the host was alive:
Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-25 10:05 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00008s latency).
Nmap done: 1 IP address (1 host up) scanned in 0.04 seconds
Using -PR is highly recommended when you are auditing an internal corporate network or a home Wi-Fi network.
Perform an ICMP Echo Sweep
In this step, you will explore the ICMP Echo Sweep technique.
While ARP is fantastic for local networks, it cannot cross routers. If you are scanning a target in a different subnet, you must use Layer 3 (Network layer) protocols. The most common method is sending an ICMP Echo Request, which is the exact same mechanism used by the standard ping command.
This is a useful example of why network layers matter in practice. The farther away the target is, the more your discovery technique depends on routable protocols instead of local-link mechanisms.
Nmap allows you to explicitly request an ICMP Echo ping using the -PE flag. In this lab, you will practice the syntax against 127.0.0.1 so the example stays self-contained, even though -PE is especially useful when checking reachable hosts beyond your local link.
Let's test the ICMP Echo sweep against the local machine:
sudo nmap -sn -PE 127.0.0.1
You will see a familiar output confirming the target responded to the ICMP probe:
Starting Nmap 7.80 ( https://nmap.org ) at 2026-10-25 10:10 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.02 seconds
Keep in mind that many modern firewalls and Windows machines block ICMP Echo requests by default to prevent discovery. Therefore, if a host does not respond to -PE, it might still be online, just ignoring the ping.
Save Discovered Hosts to a List
In this step, you will learn how to save the results of your host discovery scan to a file.
When scanning large networks, you might discover dozens or hundreds of live hosts. Relying on terminal output is not practical. You need to save these IP addresses to a file so you can feed them into other tools or perform detailed port scans on them later.
Nmap provides several output formats. The -oN flag saves the output in a "Normal" human-readable format, exactly as it appears in the terminal. You simply provide the desired filename after the flag.
Let's run a basic ping scan against 127.0.0.1 and save the results to a file named live_hosts.txt in your ~/project directory:
nmap -sn 127.0.0.1 -oN live_hosts.txt
After the scan completes, you can view the contents of the file using the cat command:
cat live_hosts.txt
The output will display the saved scan results:
## Nmap 7.80 scan initiated Wed Oct 25 10:15:00 2026 as: nmap -sn -oN live_hosts.txt 127.0.0.1
Nmap scan report for localhost (127.0.0.1)
Host is up.
## Nmap done at Wed Oct 25 10:15:00 2026 -- 1 IP address (1 host up) scanned in 0.02 seconds
By saving your results, you maintain a clear record of your network mapping phase, which is a critical best practice in any security assessment.
Summary
Congratulations! You have successfully completed the Host Discovery Strategies lab.
In this lab, you learned how to efficiently map a network by discovering live hosts without triggering noisy port scans. You practiced using the -sn flag to disable port scanning, utilized -PR for highly accurate local ARP pings, and applied -PE for standard ICMP Echo sweeps. Finally, you learned how to document your findings by saving the scan results to a file using the -oN flag.
These foundational skills are essential for any network administrator or security professional conducting reconnaissance on a target environment.
