I've read up on Nmap's website on host discovery but i'm still confused on what it actually is and does.

There's a syn scan I did on an IP address and then a syn scan without host discovery. The regular syn scan came back clean while the no host discovery mode came back with an open port.

The "syn" part I understand, but what is this "host discovery" part that my scan is performing?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 14, 2017 at 1:27

1 Answer 1


Only the hosts that pass on the Host Discovery phase (marked as discovered) will be considered for later port scanning phase. What can be confusing is that during Host Discovery you can use a simpler form of port scanning as a criteria to "discover" the hosts. But this is limited to

  • -PS (TCP SYN Ping)
  • -PA (TCP ACK Ping)
  • -PU (UDP Ping)
  • -PY (SCTP INIT Ping)

If you specify -Pn, host discovery phase is bypassed and port scanning will be done for every target IP address.

Probably what is happening is when you perform a regular scan, nmap is not marking the IP address as discovered because it fails the host discovery tests, so is not considered for later port scan phase.

You can read more about it here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.