Scanning and enumeration: discovery, port states and defences
In short: Scanning finds live hosts and open ports; enumeration pulls detail such as service versions, shares and user names. Both are standard steps in authorised testing and in attacks, so defenders reduce what scans reveal and watch for them.
Where scanning fits
After reconnaissance, a tester (or attacker) needs to know what is actually reachable. Scanning sends probes to discover hosts, open ports and services. Enumeration goes deeper, querying those services to list details such as software versions, shared folders, user accounts or SNMP data. Only scan networks you own or have written permission to test; scanning other people's systems can break the law and can disrupt fragile devices.
Host discovery and port states
Host discovery uses ICMP echo, ARP on local networks, or TCP probes to common ports to see which addresses respond. Many hosts block ping, so a lack of reply does not prove a host is down.
A port scan then checks which TCP or UDP ports respond. In a TCP SYN scan, the scanner sends a SYN; a SYN-ACK means the port is open, a RST means closed, and no reply usually means a firewall filtered it. A connect scan completes the full handshake, which is slower and more visible in logs. UDP scanning is slower and less certain, because many UDP services do not reply to empty probes.
Service detection and enumeration
Knowing port 443 is open is not enough. Service and version detection sends protocol-specific probes and reads banners to work out, for example, which web server and version is running. That version can be compared against known vulnerabilities. Enumeration examples include listing SMB shares, pulling details from an SNMP device left on a default community string, or seeing which user names an LDAP directory exposes anonymously.
Examples you can run against your own lab network (192.168.10.0/24):
sudo nmap -sn 192.168.10.0/24
sudo nmap -sS -p- 192.168.10.20
sudo nmap -sV -sC -p 22,80,443 192.168.10.20
sudo nmap -sU --top-ports 50 192.168.10.20
sudo nmap -sS -oA lab-scan 192.168.10.0/24Look up any port numbers you do not recognise with the port lookup tool, and see the Nmap lab for a guided exercise.
Defending against scanning
| Defence | Effect |
|---|---|
| Default-deny firewall rules | Only needed ports respond; everything else shows as filtered |
| Disable unused services | Fewer open ports to discover and attack |
| Segmentation | A compromised host cannot scan the whole network |
| Hide or minimise banners | Version details are harder to read |
| Secure SNMP, SMB and LDAP | Enumeration reveals much less |
| IDS/IPS and firewall alerts | Scans are spotted and investigated |
Remember that internet-facing addresses are scanned constantly by automated tools, so detection is most useful inside your network. An internal host suddenly connecting to hundreds of ports or addresses is a strong sign of compromise.
Tip: scan your own network regularly from both inside and outside. Comparing results over time is one of the simplest ways to spot unexpected services.
Practice
A SYN scan gets no response from a port. What state is it likely to be reported as, and why?
Why is UDP scanning less reliable than TCP scanning?
Why is internal scan detection often more valuable than external?
Key takeaways
- Scanning finds hosts and open ports; enumeration extracts details from services.
- Port states are open, closed and filtered (plus uncertain combinations).
- Version detection lets testers match services to known vulnerabilities.
- Default-deny rules, fewer services and segmentation limit what scans reveal.
- Only scan networks you own or are authorised in writing to test.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.