This scan type lists the hosts within the specified range that responded to a ping.It allows you to detect which computers are online, rather than which ports areopen. Four methods exist within Nmap for ping sweeping.The first method sends an ICMP ECHO REQUEST (ping request) packet tothe destination system. If an ICMP ECHO REPLY is received, the system is up,and ICMP packets are not blocked. If there is no response to the ICMP ping,Nmap will try a ”TCP Ping”, to determine whether ICMP is blocked, or if thehost is really not online.
A TCP Ping sends either a SYN or an ACK packet to any port (80 is thedefault) on the remote system. If RST, or a SYN/ACK, is returned, then theremote system is online. If the remote system does not respond, either it is offline,or the chosen port is filtered, and thus not responding to anything.When you run an Nmap ping scan as root, the default is to use the ICMP andACK methods. Non-root users will use the connect() method, which attempts toconnect to a machine, waiting for a response, and tearing down the connection assoon as it has been established (similar to the SYN/ACK method for root users,but this one establishes a full TCP connection!)The ICMP scan type can be disabled by setting -P0 (that is, zero, not uppercaseo).7
Comments :
Post a Comment