# External/Internal
## Nmap
{% hint style="success" %}
For [Nmap Docker](#nmap-docker)
{% endhint %}
{% hint style="success" %}
Nmap to Markdown: [Nmap2md](https://app.gitbook.com/o/5S34jejP8cj7fWWt6R2a/s/-Lt8335BPUBXjq3iC572/pentest-book/parsing-reporting/parsing#nmap2md)
{% endhint %}
### Network Discovery with scripts
{% code overflow="wrap" lineNumbers="true" %}
```bash
sudo nmap -sS -Pn -sV -v --top-ports 8000 --min-parallelism 20 --min-hostgroup 30 --max-rtt-timeout 300ms --max-retries 2 -oA SYN_8K_ports --script default,discovery,broadcast --open-only -iL ip_hostname.txt
```
{% endcode %}
{% hint style="info" %}
**`--script=default:`** Runs a set of default scripts that are commonly used for network discovery and general scanning. It includes basic checks for services, OS detection, and some vulnerability checks.
* **`broadcast`** category: These scripts are designed for discovering hosts and services by broadcasting requests across the network.
* **`discovery`** category: These scripts are more specific to discovering information about the network.
**`-sV`**: Detects the version of services running on open ports.
**`--open-only`** report only open ports, not closed ports.
{% endhint %}
### ICMP
This is the **easiest** and **fastest** way to discover if a host is up or not. You could try to send some **ICMP** packets and **expect responses**. The easiest way is just sending an **echo request** and expect from the response. You can do that using a simple `ping`or using `fping`for **ranges**. You could also use **nmap** to send other types of ICMP packets (this will avoid filters to common ICMP echo request-response).
{% code overflow="wrap" lineNumbers="true" %}
```bash
ping -c 1 199.66.11.4 # 1 echo request to a host
fping -g 199.66.11.0/24 # Send echo requests to ranges
nmap -PE -PM -PP -sn -n 199.66.11.0/24 #Send echo, timestamp requests and subnet mask requests
```
{% endcode %}
{% code overflow="wrap" lineNumbers="true" %}
```bash
sudo nmap -PE -PP -PM --min-parallelism 20 --min-hostgroup 30 --max-rtt-timeout 30ms --max-retries 2 -A -oA HostDiscoveryMultpleICMP Network
```
{% endcode %}
{% hint style="info" %}
**`-PE`** Use ICMP Echo Request
**`-PP`** Use ICMP Timestamp Request
**`-PM`** Use ICMP Netmask Request
{% endhint %}
### UDP Port Discovery
You could also try to check for some **UDP port open** to decide if you should **pay more attention** to a **host.** As UDP services usually **don't respond** with **any data** to a regular empty UDP probe packet it is difficult to say if a port is being filtered or open. The easiest way to decide this is to send a packet related to the running service, and as you don't know which service is running, you should try the most probable based on the port number:
{% code overflow="wrap" lineNumbers="true" %}
```bash
nmap -sU -sV --version-intensity 0 -F -n 199.66.11.53/24
# The -sV will make nmap test each possible known UDP service packet
# The "--version-intensity 0" will make nmap only test the most probable
```
{% endcode %}
The nmap line proposed before will test the **top 1000 UDP ports** in every host inside the **/24** range but even only this will take **>20min**. If need **fastest results** you can use [**udp-proto-scanner**](https://github.com/portcullislabs/udp-proto-scanner): `./udp-proto-scanner.pl 199.66.11.53/24` This will send these **UDP probes** to their **expected port** (for a /24 range this will just take 1 min): *DNSStatusRequest, DNSVersionBindReq, NBTStat, NTPRequest, RPCCheck, SNMPv3GetRequest, chargen, citrix, daytime, db2, echo, gtpv1, ike,ms-sql, ms-sql-slam, netop, ntp, rpc, snmp-public, systat, tftp, time, xdmcp.*
***
### Nmap Docker
Using the
{% code overflow="wrap" lineNumbers="true" %}
```bash
docker run --rm -it -v "\nmap:/nmap" instrumentisto/nmap -oA /nmap/
```
{% endcode %}
#### Using a list of domains/IPs
Ensure that the local file with a domain list exists, so make sure that the `` file is located in ``.
{% code overflow="wrap" lineNumbers="true" %}
```bash
docker run --rm -it -v ":/nmap" instrumentisto/nmap -oA /nmap/