Network Hacking: Host Discovery for Authorized Scopes

Host discovery answers 'who's here?' before 'what's open?' On client nets, the answer should come from approved methods—not surprise SYN floods at lunch.

Discovery techniques depend on where you're standing: external, VPN, or on-segment.

Host discovery arguments with NOC teams are easier when you show the exact rate and methods upfront. I'd rather run slower and stay invited back than win a race to enumerate every ICMP responder on day one.

Common approaches

ICMP sweeps where allowed, TCP SYN to common ports, ARP on local L2, and passive listening when active scans are banned.

Some environments prefer asset lists plus spot checks—honor that.

Fragile networks

OT, medical, and legacy ICS-adjacent subnets may react badly to scans. Get explicit timing and technique approval.

• Start with single-host probes

• Watch SOC tickets while testing

• Stop on first instability signal

Documentation

Record methods, ranges, and live host counts. Note discrepancies vs client CMDB—they're findings too.

Discovery is reconnaissance, not conquest.

Scan only IP ranges listed in your authorization letter.

If discovery results disagree with client lists, treat the delta as a conversation about shadow IT—not a secret hunting license.

Small habits compound—what feels like overhead early becomes speed when deadlines hit.

Log discovery start and stop times—clients correlate SOC alerts to your work.

IPv6 and dual-stack

Don't ignore AAAA records—some assets only answer on v6 while v4 looks dead.

Compare discovery results with client CMDB exports; ghosts and misses are both useful.

Documentation for ops

Share discovery command rates with NOC contacts if scans caused alerts—relationship maintenance matters.

IPv4-only discovery misses v6-only services; state dual-stack assumptions explicitly.

Compare ARP tables on jump boxes with scan results when investigating discrepancies.

---

Worth reading next

Network Hacking: Service Enumeration Basics

Network Hacking: Safe Engagement Practices

Scope Discovery for Web Pentests: WHOIS, ASN, and Certificates