Active Reconnaissance

• Open ports and service versions are the highest-fidelity map for 'what can we attack next'.
• Scan methodology is universally tested: tread lightly, enumerate thoroughly, then target precisely.
• Correct scan etiquette (quiet flags, scoped hosts) is what keeps you friends with the SOC monitoring your own lab.

The drone (scan) sees everything at once; the walking (targeted) finds the doors that matter.

• Host discovery (ping sweeps) finds live targets on the scoped range first, conserving effort.
• Port scans (SYN/connect) reveal open TCP/UDP listeners; service detection -sV fingerprints versions and banners.
• NSE scripts then run targeted checks on found services — each script is a deliberate probe with a purpose.
• Scan output becomes the inventory: host, open port, service, version -> the next phase's target list.

• A tester scans a scoped /28 and finds a stale RDP listener nobody knew — the whole engagement pivots on it.
• A SOC runs scheduled nmap against ITS OWN infra to compare against the change-management baseline.
• A bug bounty hunter fingerprints services to match version-specific techniques, staying within scope.

• Scan only the exact scope in the RoE — a misaimed sweep into a neighbor's /24 is out-of-scope instantly.
• Escalate noise deliberately: start quiet, then deepen only where scope and need allow.
• Save raw scan output as evidence; the report references the scan, not the memory.
• Respect rate and TCP window from the target's perspective; hammering is clumsier and more damaging.

• Blasting every port of everything 'because nmap is fast', triggering every IDS in the county.
• Trusting banner versions blindly: many services lie; confirm with a second method.
• Running aggressive NSE scripts on hosts outside the scan scope.
• Scanning blocks containing other people's addresses 'to be thorough' - out of scope is out.

• When a host ignores ping but serves HTTP, it's filtering ICMP — TCP discovery will reveal it.
• Compare -sT vs -sS results: the difference often is a firewall's SMAC setting.
• Log scan time and tool version; the report should reproduce the exact command that found the port.

• Active recon is clearly against unauthorized targets — this is the point where a scanner becomes an attacker.
• Your own lab scanning may trip the lab's own IDS; a healthy lab audit trail is a feature, not a surprise.