To get to know a new network, it makes sense to use the full subnet address, such as 192.168.1.0/24. Note: Hostnames are queried against DNS, while IPs undergo a reverse-lookup.

Here, can be hostnames, IP addresses, CIDR notation, or IP ranges. Performing your first scan with nmap # nmap -sn In addition, Nmap sends an ARP request for any hosts on the local network, filling in MAC address details. That’s why, by default, Nmap performs host discovery by sending four different probes: An ICMP type 8 (echo request), an ICMP type 13 (timestamp request), a TCP SYN packet to port 443, and a TCP ACK packet to port 80. While this might sound like a simple task, consider that a Class A network (10.0.0.0/8) has over 16 million available addresses. Making the job more difficult, most modern firewalls block ICMP echo (ping) requests. The first step in learning about a new network is to determine what's attached to your network and which services are exposed. Here's how to discover what's on your network. More than just a fancy ping sweep, with the right scans, Nmap can fill in your new network diagram with the MAC address, open ports, operating system (OS), and services of the hosts on your network. There’s no better tool to solve the problem of an unfamiliar and undocumented network than Nmap. Warning: Your employer might interpret network scanning as an attack. Please be sure you’re authorized to use Nmap before performing any scans.

If you’re new to Nmap and you need to get to know your network, then read on. This is not an article about security auditing, penetration testing, or other advanced Nmap use cases. As such, it covers simple Nmap flags to help somebody inside the network discover hosts and facts about them. This article is for discovering the scope of a network as a sysadmin in a new environment.

Red Hat OpenShift Service on AWS security FAQ.

Advanced nmap