No Ping Scan
A no ping scan prevents Nmap from doing any host discovery. It is specified with the
-Pn option. By default, Nmap only probes active machines found via host discovery. With this option selected, Nmap will do the requested scanning functions against every target IP specified, as if every one is active. This is done when it is important to find every possible active machine, including ones that may not be responsive to host discovery.
Note: This option is often combined with a no port scan (-sn).
nmap -Pn <target>
This performs a scan of
<target> without doing host discovery.
The following example runs a no ping scan on the site scanme.nmap.org:
nmap -Pn scanme.nmap.org
scanme.nmap.orgis a domain set up explicitly for people to test Nmap with.
This results in the following output:
Starting Nmap 7.93 ( https://nmap.org ) at 2022-12-02 12:14 Eastern Standard TimeNmap scan report for scanme.nmap.org (220.127.116.11)Host is up (0.083s latency).Other addresses for scanme.nmap.org (not scanned): 2600:3c01::f03c:91ff:fe18:bb2fNot shown: 992 closed tcp ports (reset)PORT STATE SERVICE22/tcp open ssh25/tcp filtered smtp80/tcp open http135/tcp filtered msrpc139/tcp filtered netbios-ssn445/tcp filtered microsoft-ds9929/tcp open nping-echo31337/tcp open EliteNmap done: 1 IP address (1 host up) scanned in 22.30 seconds