CERBERUS/nmap
1
0
Fork 0
mirror of https://github.com/nmap/nmap.git synced 2026-08-03 22:29:06 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Change -sP from "ping scan" to "don't port scan" in the documentation,

Browse source 
while still mentioning that "ping scan" is a common term. Mention the
use of -PN and -sP together to run NSE host scripts without ping and
port scanning.
This commit is contained in:
david 2009-07-17 23:47:11 +00:00
parent a3391d5401
commit 0746a7a28a
2 changed files with 44 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

21
docs/refguide.xml
View file

@ -395,22 +395,23 @@ you would expect.</para>
scanning, OS detection, or ping scanning cannot be combined
with this. If you wish to disable ping scanning while still
performing such higher level functionality, read up on the
<option>-PN</option> option.</para>
<option>-PN</option> (skip ping) option.</para>
</listitem>
</varlistentry>
<varlistentry>
<term>
<option>-sP</option> (Ping Scan)
<option>-sP</option> (Skip port scan)
<indexterm><primary><option>-sP</option></primary></indexterm>
<indexterm><primary>ping scan</primary></indexterm>
<indexterm><primary>port scan</primary><secondary>disabling with <option>-sP</option></secondary></indexterm>
</term>
<listitem>
<para>This option tells Nmap to only perform a ping scan
(host discovery), then print out the available hosts that
responded to the scan. Traceroute and NSE host scripts are
also run if requested, but no further testing (such as port
scanning or OS detection) is performed. This is by default
<para>This option tells Nmap not to do a port scan after host
discovery, and only print out the available hosts that
responded to the scan. This is often known as a <quote>ping
scan</quote>, but you can also request that traceroute and
NSE host scripts be run. This is by default
one step more intrusive than the list scan, and can often
be used for the same purposes. It allows light
reconnaissance of a target network without attracting much
@ -469,7 +470,11 @@ you would expect.</para>
Proper host discovery is skipped as with the list scan, but
instead of stopping and printing the target list, Nmap
continues to perform requested functions as if each target
IP is active. For machines on a local ethernet network, ARP
IP is active. To skip ping scan <emphasis>and</emphasis> port
scan, while still allowing NSE to run, use the two options
<option>-PN -sP</option> together.</para>
<para>For machines on a local ethernet network, ARP
scanning will still be performed (unless
<option>--send-ip</option> is specified) because Nmap needs
MAC addresses to further scan target hosts. This option flag used to be <option>P0</option> (uses zero), but was renamed to avoid confusion with protocol ping's <option>PO</option> (uses the letter O) flag.</para>

31
docs/scripting.xml
View file

@ -194,6 +194,22 @@ Nmap done: 1 IP address (1 host up) scanned in 0.33 seconds
are generally only used for script debugging and development. Script scanning is also included as part of the <option>-A</option> (aggressive scan) option.
</para>
<para>
Script scanning is normally done in combination with a port scan,
because scripts may be run or not run depending on the port states
found by the scan. With the <option>-sP</option> option it is
possible to run a script scan without a port scan, only host
discovery. In this case only host scripts will be eligible to run.
To run a script scan with neither a host discovery nor a port scan,
use the <option>-PN -sP</option> options together with
<option>-sC</option> or <option>--script</option>. Every host will
be assumed up and still only host scripts will be run. This
technique is useful for scripts like
<filename>whois.nse</filename><indexterm><primary><filename>whois.nse</filename></primary></indexterm>
that only use the remote system's address and don't require it to be
up.
</para>
<para>
Scripts are not run in a sandbox and thus could accidentally or
maliciously damage your system or invade your privacy. Never run
@ -766,6 +782,21 @@ local username = nmap.registry.args.user
scripts.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><command>nmap -sP -sC example.com</command></term>
<listitem>
<para>A script scan without a port scan; only host scripts are
eligible to run.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><command>nmap -PN -sP -sC example.com</command></term>
<listitem>
<para>A script scan without host discovery or a port scan. All
hosts are assumed up and only host scripts are eligible to
run.</para>
</listitem>
</varlistentry>
<varlistentry>
<indexterm><primary><option>--script-trace</option></primary><secondary>example of</secondary></indexterm>
<term><command>nmap --script smb-os-discovery --script-trace example.com</command></term>