Active Discovery

Active discovery is the first phase that sends packets to hosts nobody invited you to touch. Its job is narrow on purpose: turn the addresses you learned passively into a list of live hosts and the protocol that identifies each one, so the scan that follows has targets instead of guesses.

Host Discovery

Use more than one discovery method and reconcile the answers. Each method fails in a different way, and the set of hosts that respond to ARP but not to ICMP is not an edge case — it is the normal state of a hardened Windows estate, where the host firewall drops echo requests while the machine is perfectly alive.

ARP Scanning (Layer 2)

On the local segment ARP is the only reliable discovery method: a host cannot ignore an ARP request without losing its own connectivity, and the reply proves the machine exists rather than that a firewall rule allows probing. An ARP sweep also returns MAC addresses, which give you the vendor before you open a port. It does not cross a router, so run it once per segment and treat the results as authoritative for that segment only.

# ARP scan - fastest for local subnet (Layer 2)
sudo arp-scan -l -I eth0

# Specify range
sudo arp-scan -I eth0 10.0.0.0/24

# Multiple subnets
sudo arp-scan -I eth0 10.0.0.0/24 10.0.1.0/24

# Netdiscover active mode
sudo netdiscover -i eth0 -r 10.0.0.0/24

ICMP Discovery

A ping sweep is the fastest way to cover a routed range and the easiest to be wrong about. Hosts that do not answer -sn are "down" only in the sense that they did not answer; Windows Firewall blocks inbound echo by default on the public and domain profiles, so expect the majority of workstations to be missing from the results. fping -a is worth preferring on large ranges because it keeps state per host and finishes in seconds, and the timestamped variant gives you a timeline you can compare against a later sweep.

# Ping sweep with nmap
nmap -sn 10.0.0.0/24

# Faster ping sweep (no DNS resolution)
nmap -sn -n 10.0.0.0/24

# Using fping (faster for large ranges)
fping -a -g 10.0.0.0/24 2>/dev/null

# With timestamps
fping -a -g 10.0.0.0/24 2>/dev/null | while read ip; do
  echo "$(date +%H:%M:%S) - $ip"
done

TCP/UDP Discovery

When ICMP is filtered, ask a service instead. A SYN to a closed port still returns a RST from a live host, which is why -PS finds machines that -sn alone misses; -PA catches hosts that drop SYNs but answer ACKs; -PU on 53 or 161 reaches hosts that filter all TCP. Combine them in one pass rather than three, and treat a host that appears in none of the three as genuinely absent — or as being filtered by an inline device, which is itself worth reporting.

# TCP SYN discovery (when ICMP blocked)
nmap -sn -PS22,80,443,445 10.0.0.0/24

# TCP ACK discovery
nmap -sn -PA80,443 10.0.0.0/24

# UDP discovery
nmap -sn -PU53,161 10.0.0.0/24

# Combined discovery
nmap -sn -PS22,80,443,445 -PA80,443 -PU53,161 10.0.0.0/24

# Using masscan for speed
sudo masscan 10.0.0.0/24 -p22,80,443,445 --rate=1000

Port Scanning

Port scanning, service and version detection, NSE scripts and vulnerability scanning are owned by the Scanning page, where the workflow, timing templates and output formats are covered in one place. The division of labour is deliberate: this page answers "which hosts exist and what identifies them", that page answers "what is listening on them and how is it configured". Do not spend the discovery phase on a full -p- sweep — you will generate the engagement's loudest traffic before you know which addresses deserve it.

SMB Discovery

An unauthenticated SMB sweep is the single highest-value discovery step on a Windows network, because the protocol answers with more than "open": each responding host returns its NetBIOS name, domain, OS build, SMB dialect and signing state. Read the output column by column. The host line tells you which domain the machine belongs to and therefore whether a trust boundary is in play; SMBv1: True is a legacy finding; and signing status is the input to the relay work on the Relay Attacks page, which is why --gen-relay-list is worth running even at this stage. Hosts that answer on 445 but return STATUS_NOT_SUPPORTED are usually appliances or NAS devices with their own bugs, and they are easy to pick out because the OS field is blank.

# Identify SMB hosts
nmap -p 445 --open 10.0.0.0/24

# nxc SMB scan
nxc smb 10.0.0.0/24

# Identify domain controllers
nxc smb 10.0.0.0/24 | grep -i "domain"

# Generate relay target list (SMB signing disabled)
nxc smb 10.0.0.0/24 --gen-relay-list relay_targets.txt

# Enumerate shares (null session)
nxc smb 10.0.0.0/24 --shares

Domain Controller Discovery

You do not need credentials to find the DCs, and you should find all of them before you touch LDAP: the domain's SRV records list every DC in the site, and the PDC emulator record names the one that holds the account-lockout authority. DNS is the cheapest source and the one least likely to alert. The port signature — 88, 389, 636, 3268, 3269 open together — is the confirmation, and ldap-rootdse returns defaultNamingContext, which is the base DN every query on the next page needs. Full DC enumeration and per-DC role analysis belong to the Scanning page; this section gives you the list to feed it.

# DNS-based DC discovery
nslookup -type=SRV _ldap._tcp.dc._msdcs.DOMAIN.COM
nslookup -type=SRV _kerberos._tcp.DOMAIN.COM
nslookup -type=SRV _gc._tcp.DOMAIN.COM

# Find PDC
nslookup -type=SRV _ldap._tcp.pdc._msdcs.DOMAIN.COM

# LDAP banner grab (returns defaultNamingContext)
nmap -p 389 --script ldap-rootdse 10.0.0.1

Service-Specific Discovery

Once you have live hosts, classify them by the port that identifies their role rather than scanning everything: 1433, 1434, 3306, 5432, 1521 and 27017 mark database servers; 80, 443, 8080 and 8443 mark web front ends and internal applications; 3389, 22, 5985 and 5900 mark remote access paths, which are the lateral-movement candidates; 161, 9100, 515 and 631 mark network devices and printers, which are usually the least patched things on the network. Scan only the ports that would change your plan — a full port sweep of a /24 at this stage produces a lot of alerting for a list you will re-derive during scanning anyway. The commands and timing guidance for each service family live on the Scanning page; enumeration of the services themselves is on Database Enumeration and SMB Enumeration.

Scan Optimization

The two-tool pipeline exists because the tools fail differently. Masscan is stateless and asynchronous, so it can cover a /16 in minutes and will also miss hosts behind a rate limiter or a load balancer; nmap is slower because it tracks state and retransmits, which is what makes its results trustworthy. Use masscan to find the open ports, then nmap to confirm the ones that matter. Keep --rate conservative on a production network: a high rate is the fastest way to saturate a WAN link or to have the client's IPS drop your source address mid-engagement.

# Masscan for speed (then nmap for accuracy)
# Phase 1: Fast discovery
sudo masscan 10.0.0.0/16 -p 21,22,23,25,53,80,88,110,135,139,143,389,443,445,636,1433,3306,3389,5432,8080 --rate=10000 -oG masscan_results.txt

# Phase 2: Parse masscan output
grep "Ports:" masscan_results.txt | awk '{print $4}' | cut -d'/' -f1 | sort -u > ports.txt
grep "Ports:" masscan_results.txt | awk '{print $2}' | sort -u > hosts.txt

# Phase 3: Detailed nmap scan
nmap -sV -sC -iL hosts.txt -p $(cat ports.txt | tr '\n' ',') -oA detailed_scan

What the Defender Sees

Discovery is the phase where the blue team is most likely to notice you, and the honest framing is that a sweep which produces no alerts may mean the estate has no network monitoring rather than that your technique was quiet. What each method leaves behind:

• ARP and ICMP sweeps: nothing in host logs. Visible only in NetFlow, switch port statistics or an IDS tuned for scan patterns — which is why the network team's detection coverage is worth asking about before the first sweep.
• SMB sweep: a 4625 on every host where the credential failed, and a burst of 445 connections from one source. This is the noisiest discovery method and the most useful, so run it once with a deliberate credential rather than repeatedly with guesses.
• DNS SRV lookups: standard queries in the DNS server log, indistinguishable from a workstation locating a DC. The quietest DC discovery available.
• Port scans: firewall and IDS records for every SYN; a horizontal scan of one port across a subnet is the classic signature. Rate is the variable you control.

Quick Reference

Evidence Collection

False Positive Identification

Testing Checklist

Remediation & Defense