Get to Know Your Tools: Nmap Ping Subnet Scan

Tony Fortunato of The Technology Firm uses Wireshark to observe how nmap discovers a subnet.

Tony Fortunato

October 20, 2021

In this article, I use nmap, a popular utility, to illustrate a simple example.

For those familiar with my work, I always mention that you should 'know your tools,' so I won't beat that point to death. I have plenty of examples on my website in case you are new to my work.

When you use the -sn subnet option in nmap, the help screen mention that it is a "Ping Scan." Most analysts know ping and probably know that ping uses ICMP as its protocol. Well, in this video, you will see how I used Wireshark to observe how nmap discovers a subnet and if it uses ICMP to accomplish this.

With this specific option on Windows 10, the utility uses ARP for its discovery mechanism.

When you think about it, ARP is a much better protocol to use since ICMP could be rerouted, blocked, or response spoofed. After you figure out your tool behavior, understanding how it behaves on your network and devices becomes obvious.

I encourage you to spend a few minutes with your favorite troubleshooting tools to figure out how they behave. Don’t forget to retest your favorite software with devices and networks you are familiar with whenever a new version comes out to ensure the tool still reports the results the same way and that behavior hasn’t changed.

See other hands-on tool reviews by Tony Fortunato here.

About the Author(s)

Tony Fortunato

Sr Network Performance Specialist

Tony Fortunato is a network performance expert who has been designing, implementing and troubleshooting networks since 1989. His company, The Technology Firm, provides clients of all sizes with services ranging from project management, network design, consulting, troubleshooting, designing custom-designed training courses, and assisting with equipment installation. Tony's experience in networking started with financial trading floor networks and ISPs, where he learned to integrate and support equipment from various vendors. Tony has taught and presented at numerous colleges and universities, public forums and private classes. He blogs frequently at NetworkDataPediaand has a popular YouTube channel.

Stay informed! Sign up to get expert advice and insight delivered direct to your inbox

You May Also Like

More Insights