Path and Host Discovery
← Reference index · Next: TCP scanning | Strategy map | Study methods: Discover attack surfaces
Purpose: Confirm the source path and discover explicitly assigned hosts before spending time on port coverage.
1. Check the path
From the target's working folder:
mkdir -p scans
ip -br addr
ip route get TARGET
Read: selected interface/source address. A route lookup does not prove reachability.
Variants — discover one host, a host list or a subnet
Host discovery
One host:
nmap -sn -n -oA scans/host TARGET
Assigned list: put IPs in targets.txt, one per line.
nmap -sn -n -iL targets.txt -oA scans/hosts
Explicitly assigned subnet:
nmap -sn -n -oA scans/subnet SUBNET
No response does not establish that a host is offline. A list of assigned hosts does not imply the surrounding subnet is in scope.