Host Discovery

What is it?

Host discovery (the 'ping scan') finds which addresses in a range are alive before you scan ports, using ICMP and small TCP/ARP probes. It answers 'which hosts exist?' cheaply.

Why it matters

Scanning every port on every address in a /16 is slow and noisy. Discovering live hosts first focuses effort and reduces the footprint of your scan.

Where you see it

A first pass over a subnet returns 'host is up' for the addresses that answered, which you then port-scan.

What normal looks like

The count of live hosts matches your asset inventory for that segment.

What suspicious looks like

A live host at an address that should be empty — a rogue or unmanaged device — or fewer hosts than expected because a firewall blocks discovery probes.

How analysts investigate

Run discovery, reconcile live hosts against inventory, and remember that a non-responding host may be firewalled rather than absent — confirm before concluding.

Common beginner mistakes

Concluding a host is offline when discovery probes are simply firewalled.
Skipping discovery and port-scanning an entire large range blindly.

Who is home before you knock on every door

  discovery over 10.20.4.0/24:
    10.20.4.1   up   (gateway)
    10.20.4.10  up   (web)
    10.20.4.55  up   (UNKNOWN — not in inventory)
    10.20.4.99  down / filtered  (firewall may hide it)
  → port-scan only the live hosts; investigate the unknown one

Discovery finds live hosts cheaply; reconcile them against inventory before deeper scanning.

Quick check

A host does not respond to discovery. Can you conclude it is offline?

A quick self-check — it doesn't affect your XP or progress.