Network Scanning Techniques

Network scanning identifies which hosts are alive, what ports are open, and what services are running, forming the bridge between reconnaissance and vulnerability analysis.

Host Discovery

Before scanning ports, testers first identify which devices on a network are actually active, typically using ping sweeps or ARP requests within the local network segment.

Types of Network Scans

Techniques range from simple ICMP-based scans to more advanced TCP and UDP scans, each with different trade-offs between speed, accuracy, and how easily they're detected.

Identifying Services and Versions

Beyond finding open ports, testers try to determine which services and software versions are running, since outdated versions are often the entry point for known exploits.

Moving Toward Vulnerability Analysis

The results of network scanning directly inform which systems and services need deeper vulnerability analysis, making accurate scanning essential to an effective assessment.