Find the live hosts#

The scanner probes each address before it scans it, so a host that stays silent drops out of the results rather than appearing with nothing open.

Before the scanner scans ports, it works out which addresses are worth a scan at all. A /24 range holds 256 addresses, and most networks use a fraction of them. Discovery is what keeps a scan off empty space.

A mistake here is silent. The scanner treats a host that does not answer the discovery probes as down, and never scans its ports. The host disappears from the results entirely rather than appearing with nothing open.

The Host Discovery panel with Skip Discovery, ICMP Echo and ICMP Timestamp checkboxes and a tooltip explaining Skip Discovery

The ICMP and port probes#

Five probes look for a live host:

  • ICMP Echo: on by default. It is an ordinary ping, and it is the fastest way to find hosts on a network that permits it.
  • ICMP Timestamp: off by default. It asks the same question a different way, and it sometimes reaches hosts behind firewalls that block echo requests specifically.
  • TCP SYN Ping: defaults to ports 80 and 443, because a host that runs a web server answers on one of them.
  • TCP ACK Ping: empty by default. ACK probes can pass through stateless firewalls that drop a SYN.
  • UDP Ping: empty by default.

The three port fields probe with TCP and UDP instead of ICMP. This matters, because many networks drop ICMP entirely and still leave services reachable. All three take comma-separated port numbers, and each field commits when you click away from it. As with the custom port list, the scanner discards invalid entries without a message.

Skip discovery entirely#

Skip Discovery treats every address in the range as alive and scans all of them. It disables the ICMP options and hides the port fields, because none of them apply.

Use it when you know the hosts are there and are not answering probes. A hardened network where every device drops ICMP and unsolicited TCP will otherwise come back empty.

The cost is time, and it scales badly. On a /24 the scanner covers 256 hosts rather than the handful that are up, so a scan of one minute can take most of an hour. On a single known address the option costs nothing, and it removes one way for the scan to be wrong.

Select a probe combination#

For a network you administer, the defaults are usually right: ICMP echo and SYN probes to the two web ports find nearly everything.

If a network returns fewer hosts than you expected, add ICMP Timestamp and enter a few ports you know are in use into TCP SYN Ping. Try that before you use Skip Discovery, because wider probes cost less than no discovery at all.