Why you find the live hosts first
Imagine you are handed a single /24 network — 10.0.0.0/24, which is 256 addresses. On a real network, the overwhelming majority of those addresses have nothing on them. A handful of servers, a few workstations, a printer, a switch management interface — the rest is empty. If you start by hammering every one of those 256 addresses with a full port scan, you spend most of your time waiting for replies from machines that do not exist.
So you split the job in two. Host discovery answers one narrow question — which addresses are alive? — and nothing more. Only once you have that short list do you spend the expensive effort of scanning ports, and you spend it only on the hosts that are actually there. This is the first step where you reach out and touch the target, so it is also the first step that can be seen: every probe you send is a packet that something on the other side may log.
The probe techniques
"Is this host alive?" has no single right answer — it depends on what the host and the network in between will respond to. So Nmap carries several different probes, each poking the target in a different way. A firewall that silently drops one kind of probe will often happily answer another, which is why a good sweep usually fires more than one technique and treats any reply as proof of life.
| Technique | Nmap flag | How it works | When to use |
|---|---|---|---|
| ARP scan | -PR | Asks "who has this IP?" at the link layer. A host on the same segment must answer ARP to be reachable at all, so it cannot hide. | The most reliable probe — but only on the local LAN segment. Nmap uses it automatically when the target is on your own subnet. |
| ICMP echo (ping) | -PE | Sends a classic ICMP echo request and waits for the echo reply — the same thing the ping command does. | Quick and simple, but frequently filtered by firewalls, so a lack of reply proves nothing. |
| TCP SYN ping | -PS<ports> | Sends a TCP SYN to chosen ports (e.g. -PS80,443). Any SYN/ACK or RST that comes back proves the host is up. | When ICMP is blocked but common service ports are not — reaches web and other servers that refuse to answer ping. |
| TCP ACK ping | -PA | Sends a bare TCP ACK; a live host replies with a RST. Slips past simple stateless filters that only block new connections. | As a second opinion alongside SYN ping when you suspect basic packet filtering is in the way. |
| UDP ping | -PU | Sends a UDP packet to a port; a closed port answers with an ICMP "port unreachable," which still confirms the host exists. | When TCP probes are filtered but UDP is overlooked — a useful angle past rules that only mind TCP. |
Notice the pattern: every one of these works by getting some response — an ARP reply, an echo, a SYN/ACK, a RST, an ICMP error. It does not matter which one you provoke. The moment the target sends anything back, you know an address is occupied, and that address goes on the live-host list.
The ping-only scan: -sn
When you just want an inventory — what is alive in this range? — you tell Nmap to do host discovery and then stop, without scanning any ports:
The -sn flag means "no port scan." Nmap sends its discovery probes across all 256 addresses, lists the ones that answer, and quits. (Older guides call this a "ping scan," and the flag used to be -sP; -sn is the modern spelling.) Despite the name, it does more than a plain ICMP ping — on a local segment it leans on ARP, and against remote targets it fires a default mix of ICMP and TCP probes so a single blocked technique does not make a live host vanish.
The result is exactly the short roster you wanted: a clean list of live addresses, produced in seconds, with none of the cost of a port scan. That roster is the thing you carry into the next phase.
The firewall problem — and -Pn
Here is the trap that catches people early: "host seems down" does not mean the host is down. Plenty of machines are deliberately configured to ignore discovery probes — a hardened server may drop ICMP and refuse to answer the common ports Nmap probes by default. To a discovery sweep that host looks dead, even though it is sitting right there serving traffic. Silence is not absence; it is often just a firewall doing its job.
This matters most when your earlier reconnaissance has already told you a host exists — you have a hostname, a DNS record, a service you have seen respond — and yet discovery insists it is down. For exactly that situation, Nmap gives you an override:
The -Pn flag means "skip host discovery entirely — treat every target as up" and go straight to scanning. You are telling Nmap to stop asking "is it alive?" and simply assume yes. That rescues hosts that refuse to answer probes, but it has a real cost: if you point -Pn at a whole range, Nmap will dutifully port-scan every empty address as though it were a live machine — slow, and noisy. Use it when you have good reason to believe a target is up, not as a blanket setting for an entire subnet.
Reading the result — and what comes next
Whatever combination of probes you used, the output of host discovery is one concrete artifact: a list of live hosts. That list is not the goal in itself — it is the input to everything that follows. The next lesson, port scanning, takes this roster and asks the next question of each address: which doors are open? Discovery tells you the house is occupied; port scanning tells you which windows are unlocked.
Two habits to carry forward as you sweep:
- Stay inside scope. A /24 is easy to type and easy to over-shoot. Only sweep the ranges you are authorized to touch — discovery is the first step that reaches out and announces your presence on the wire.
- Mind the noise. Every probe is a packet someone can log. A quiet, targeted sweep draws far less attention than blasting every technique at every address, and on a real engagement that restraint is part of the job.
If you want to confirm what a given host is — resolving a name, checking a route, or testing reachability by hand — the basic terminal lookups in terminal network commands are the natural companion to an Nmap sweep. With a verified list of live hosts in hand, you are ready to turn each one inside out.