nmap

https://tools.kali.org/information-gathering/nmap

https://www.linux.com/learn/beginners-guide-nmap

Host discovery

nmap -sn $network

-sn: Ping Scan (ICMP)

• Scan the entire subnet: $network="192.168.0.0/24" will scan for all online hosts on the range from 192.168.0.1 through 192.168.0.254.
• Alternatively, narrow your search by specifying a range of IP addresses: $network="192.168.0.1-15" will reach hosts 192.168.0.1 through 192.168.0.15. nmap can be used with evasive solutions such as mac address spoofing to avoid intrusion detection systems.

Port Scan

nmap -O -F -sS $target_ip

-O: Enable OS detection

-F: Scan 100 most common ports (Fast)

-sS: TCP SYN scan (requires elevated privileges)