Basic scanning is the foundation of network enumeration. Nmap is the primary tool used for discovering hosts, identifying open ports, and understanding the initial attack surface. Before advanced scans or service-specific enumeration, pentesters begin with basic scanning to map targets, confirm live hosts, and identify which services are exposed. This phase sets the direction for all later testing.

Understanding Basic Scanning

Basic scanning focuses on discovering which systems are online and which ports are open. It does not perform deep analysis, version detection, or vulnerability checks. Instead, it builds the core map of reachable targets.

Basic scans reveal:

Active hosts
Open TCP or UDP ports
Basic firewall behavior
Simple host response patterns

Once this information is collected, pentesters move into detailed enumeration.

Host Discovery

Host discovery identifies live systems on the network. It determines which IP addresses are reachable and responding.

ICMP Ping Sweep

nmap -sn 10.10.10.0/24

This performs a ping scan and lists all responsive hosts.

ARP Scan (Local Network)

nmap -PR -sn 10.10.10.0/24

ARP scans work reliably inside LANs and detect hosts even when ICMP is blocked.

Treating All Hosts as Up

If firewalls block pings, pentesters use:

nmap -Pn 10.10.10.5

This skips host discovery and scans the target directly.

Basic Port Scanning

Port scanning identifies which services are reachable. Basic scans use fast and simple techniques.

Fast TCP Scan

nmap 10.10.10.5

This defaults to scanning the 1000 most common ports.

Scanning All TCP Ports

nmap -p- 10.10.10.5

This checks all 65,535 ports to find hidden or uncommon services.

Fast All-Port Scan

nmap -p- --min-rate 10000 10.10.10.5

This increases speed, useful in CTFs or time-limited tests.

Understanding Port States

Basic scans categorize ports into major states:

Open – service is accepting connections
Closed – reachable but no service
Filtered – blocked by firewall
Unfiltered – reachable but state unclear

These states influence the next steps of enumeration.

Scanning UDP Ports

UDP services require a different technique because they do not respond reliably.

Common UDP Scan

nmap -sU 10.10.10.5

This identifies services like DNS, SNMP, and NTP.

Fast UDP Scan

nmap -sU --top-ports 50 10.10.10.5

This focuses on the most commonly used UDP ports.

Combining Host and Port Scanning

Efficient pentesters combine steps to save time.

Host Discovery + Port Scan

nmap -sn --open 10.10.10.0/24

This finds live hosts showing open ports.

Multiple Hosts Fast Scan

nmap -F 10.10.10.0/24

This scans common ports across an entire subnet quickly.

Scan Timing and Stealth

Basic scanning must consider detection, performance, and stealth.

Slowing Scans for Stealth

nmap -T2 10.10.10.5

Lower timing reduces IDS alerts.

Speeding Up for Large Networks

nmap -T5 10.10.10.0/24

Higher timing speeds up the process but increases detection.

Basic Output Interpretation

After scanning, pentesters record:

IP addresses
Open ports
Common services
Firewall indicators
Unusual port behavior

This basic map becomes the starting point for detailed enumeration.

Why Basic Scanning Matters

Basic scanning gives the first clear view of the target environment. It identifies the live hosts, reachable services, and firewall behavior that shape the rest of the pentest. Without accurate basic scanning, deeper enumeration and exploitation become inefficient or incomplete.

Intel Dump

Basic scanning identifies live hosts and open ports
ICMP, ARP, and -Pn methods detect active systems
TCP and UDP scans map reachable services
Port states guide next steps
Timing and speed affect detection and performance
Basic scans create the foundation for deeper Nmap and service enumeration