Network Reconnaissance

Port scanning tells us what services run on individual hosts. But effective reconnaissance requires understanding the bigger picture—how many hosts exist, how they connect to each other, what roles they serve, and how the network is architecturally organized.

Network mapping is the practice of discovering and documenting network infrastructure. It answers critical questions:

• How many live hosts exist in the target network?
• What is the network topology and segmentation?
• Where are the routers, firewalls, and critical chokepoints?
• Which hosts are servers vs. workstations vs. network devices?
• What operating systems run on each host?

A comprehensive network map transforms a vague target into a detailed understanding that guides subsequent attack planning—or, from a defensive perspective, reveals the attacker's view of your infrastructure.

Before scanning ports or probing services, we must determine which IP addresses have live hosts. Scanning every port on every possible IP would be prohibitively slow—host discovery narrows the target list to actual systems.

The challenge:

• IP address ranges can be enormous (/16 = 65,536 addresses)
• Not every IP has an active host
• Hosts may be configured to ignore probes
• Firewalls may block discovery attempts

Discovery techniques range from simple to sophisticated, each with different detection characteristics and reliability.

ICMP Echo Request (Traditional Ping):

The classic ping sends an ICMP Echo Request and waits for an ICMP Echo Reply:

ping 192.168.1.1
# PING 192.168.1.1: 56 data bytes
# 64 bytes from 192.168.1.1: icmp_seq=0 ttl=64 time=0.5ms

Advantages:

• Simple, universally understood
• Built into every OS
• Quick response time

Disadvantages:

• Commonly blocked by firewalls
• Many hosts configured to ignore ICMP
• Very obvious in traffic analysis

When ICMP is blocked, TCP and UDP probes offer alternatives. These leverage the fact that most firewalls must allow some TCP/UDP traffic—otherwise the network would be non-functional.

TCP SYN Ping:

Send a SYN packet to a commonly open port (80, 443, 22). A live host responds with either:

• SYN-ACK: Port is open (host is alive)
• RST: Port is closed (host is still alive)

Either response confirms the host exists—only silence or ICMP unreachable indicates no host.

TCP ACK Ping:

Send an ACK packet to a target port. Per TCP specification:

• If host exists, it should respond with RST (connection doesn't exist)
• Stateful firewalls may drop unsolicited ACKs
• Useful when SYN packets are blocked but ACK allowed

UDP Ping:

Send UDP packets to commonly closed ports:

• Closed port generates ICMP Port Unreachable → host alive
• Open port might not respond → uncertain
• Filtered → no response → uncertain

UDP discovery is less reliable but may succeed when TCP is blocked.

When scanning on the local network segment (same broadcast domain), ARP discovery is the most reliable technique. ARP operates at Layer 2, below IP—hosts cannot avoid responding without breaking fundamental network functionality.

How ARP discovery works:

1. Scanner broadcasts ARP request: "Who has 192.168.1.X?"
2. If host exists, it responds: "192.168.1.X is at AA:BB:CC:DD:EE:FF"
3. Response proves host exists and reveals MAC address

Why ARP is impossible to block:

• No IP communication works without ARP
• Hosts must respond to ARP for their own IP
• Even hosts blocking all ICMP/TCP/UDP must answer ARP
• Only exception: hosts using static ARP entries for every possibility (impractical)

MAC address analysis:

ARP reveals MAC addresses, which contain valuable information:

MAC: 00:50:56:XX:XX:XX → VMware virtual machine
MAC: 08:00:27:XX:XX:XX → VirtualBox virtual machine
MAC: B8:27:EB:XX:XX:XX → Raspberry Pi
MAC: 00:0C:29:XX:XX:XX → VMware virtual machine
MAC: DC:A6:32:XX:XX:XX → Raspberry Pi (newer)

The first 3 bytes (OUI - Organizationally Unique Identifier) identify the manufacturer. This helps classify devices:

• Virtual machines (different attack surfaces than physical)
• IoT devices (often weaker security)
• Network equipment (routers, switches)
• Mobile devices vs. workstations

Understanding the path between you and the target reveals network topology—routers, firewalls, ISP boundaries, and geographic distribution. Traceroute is the fundamental tool for path discovery.

How traceroute works:

Traceroute exploits the TTL (Time To Live) field in IP headers:

1. Send packet with TTL=1
2. First router decrements TTL to 0, drops packet, sends ICMP Time Exceeded
3. Record that router's address
4. Send packet with TTL=2
5. Second router sends Time Exceeded
6. Repeat until reaching destination (or max hops)

Interpreting traceroute results:

Determining the operating system on remote hosts is crucial—exploit compatibility, vulnerability databases, and attack strategies all depend on accurate OS identification.

The principle:

Different operating systems implement TCP/IP standards slightly differently. While packets are interoperable, subtle implementation details create unique "fingerprints":

• Initial TTL values
• TCP window sizes
• TCP options order and values
• Response to unusual/malformed packets
• ICMP response characteristics
• Fragmentation handling

nmap OS detection:

nmap maintains a database of over 5,000 OS fingerprints:

# OS detection (requires root)
sudo nmap -O target.com

# Aggressive OS detection
sudo nmap -O --osscan-guess target.com

# Combine with version detection
sudo nmap -O -sV target.com

Sample output:

Running: Microsoft Windows 10
OS CPE: cpe:/o:microsoft:windows_10
OS details: Microsoft Windows 10 1709 - 1909
Network Distance: 2 hops

Combining host discovery, path analysis, and service detection creates a comprehensive network map. This map reveals the architecture an attacker will exploit—or a defender should secure.

Key topology elements to identify:

1. Network boundaries: Where one network ends and another begins
2. Chokepoints: Routers and firewalls controlling traffic flow
3. Segments: VLANs, subnets, and trust zones
4. Critical assets: Servers holding valuable data
5. Trust relationships: How segments communicate

Building the map programmatically:

# Discover live hosts
nmap -sn 192.168.1.0/24 -oG live_hosts.txt

# For each host, identify services
for ip in $(grep "Up" live_hosts.txt | cut -d" " -f2); do
    nmap -sV -O $ip -oX scan_$ip.xml
done

# Traceroute to multiple targets
for ip in $(cat key_targets.txt); do
    traceroute $ip >> topology.txt
done

Visualization:

Once data is collected, map it visually:

• Network diagrams showing subnets and connections
• Host inventories with services and OS
• Attack path analysis from entry points to targets

DNS is a goldmine for reconnaissance. Organizations often leave DNS records that reveal internal structure, naming conventions, and relationships—all accessible without touching the target directly.

DNS enumeration techniques:

Subdomain enumeration:

Finding subdomains reveals additional attack surface. Techniques include:

1. Dictionary attacks: Try common subdomain names
2. Certificate transparency: Query CT logs for all certificates issued to domain
3. Search engine dorking: site:example.com shows indexed subdomains
4. DNS brute forcing: Systematically try combinations
5. Passive DNS: Historical DNS records from various sources

Tools for subdomain enumeration:

• Sublist3r: Combines multiple sources
• Amass: Comprehensive, uses many data sources
• Subfinder: Fast passive enumeration
• dnsrecon: DNS-specific reconnaissance

While determined attackers will eventually map your network, effective defenses increase the time, effort, and detection risk for reconnaissance activities.

Defense layers:

Detection priorities:

Network mapping transforms a target address into a comprehensive understanding of infrastructure. Let's consolidate the key concepts:

What's next:

With hosts discovered and mapped, the next reconnaissance phase is Vulnerability Scanning—systematically probing discovered services for known weaknesses that can be exploited.