# Network Enumeration

#### Scan Network using nmap -sn to disable port scan

```
sudo nmap 10.129.2.0/24 -sn -oA tnet | grep for | cut -d" " -f5
```

#### -iL to perform defined scans

```
sudo nmap -sn -oA tnet -iL hosts.lst | grep for | cut -d" " -f5
```

#### Other flags

<table data-header-hidden><thead><tr><th width="203"></th><th></th></tr></thead><tbody><tr><td>-PE</td><td>Performs the ping scan by using 'ICMP Echo requests' against the target.</td></tr><tr><td>--packet-trace</td><td>Shows all packets sent and received</td></tr><tr><td>--reason</td><td>Displays the reason for specific result.</td></tr><tr><td>--disable-arp-ping</td><td>Use ICMP instead of ARP</td></tr><tr><td>--reason</td><td>Displays the reason a port is in a particular state.</td></tr><tr><td>-n</td><td>Disables DNS resolution</td></tr><tr><td>--stats-every=5s</td><td>Shows the progress of the scan every 5 seconds.</td></tr><tr><td>-A</td><td>Enables OS detection and Version detection, Script scanning and Traceroute.</td></tr><tr><td>-sT</td><td>TCP connect scan (3-way handshake)</td></tr><tr><td>-sU</td><td>UDP scan</td></tr></tbody></table>

#### TTL Values of different OS

[Default TTL (Time To Live) Values of Different OS - Subin's Blog (subinsb.com)](https://subinsb.com/default-device-ttl-values/)

#### Port Status

<table data-header-hidden><thead><tr><th width="164"></th><th></th></tr></thead><tbody><tr><td>State</td><td>Description</td></tr><tr><td>open</td><td>This indicates that the connection to the scanned port has been established. These connections can be TCP connections, UDP datagramsas well as SCTP associations.</td></tr><tr><td>closed</td><td>When the port is shown as closed, the TCP protocol indicates that the packet we received back contains an RSTflag. This scanning method can also be used to determine if our target is alive or not.</td></tr><tr><td>filtered</td><td>Nmap cannot correctly identify whether the scanned port is open or closed because either no response is returned from the target for the port or we get an error code from the target.</td></tr><tr><td>unfiltered</td><td>This state of a port only occurs during the TCP-ACKscan and means that the port is accessible, but it cannot be determined whether it is open or closed.</td></tr><tr><td>open|filtered</td><td>If we do not get a response for a specific port, Nmapwill set it to that state. This indicates that a firewall or packet filter may protect the port.</td></tr><tr><td>closed|filtered</td><td>This state only occurs in the IP ID idlescans and indicates that it was impossible to determine if the scanned port is closed or filtered by a firewall.</td></tr></tbody></table>

#### Additional Flags

<table data-header-hidden><thead><tr><th width="198"></th><th></th></tr></thead><tbody><tr><td>--min-parallelism</td><td>which frequency</td></tr><tr><td>--max-rtt-timeout</td><td>which timeout (100ms for example)</td></tr><tr><td>--min-rate</td><td>number of packets sent simultaneously</td></tr><tr><td>--max-retries</td><td>number of retries (default is 10)</td></tr></tbody></table>

#### -T Flags

| Value | Meaning    |
| ----- | ---------- |
| 0     | Paranoid   |
| 1     | Sneaky     |
| 2     | Polite     |
| 3     | Normal     |
| 4     | Aggressive |
| 5     | Insane     |
