~/tutorials/032-the-first-question-is-not-what-is-open.md

032: The first question is not what is open

It is: am I allowed to ask.

This shell has answered that question the same way since lesson four. Aim it at anything but itself and it refuses:

nmap scanme.nmap.org

nmap: scanme.nmap.org: Permission denied by this shell.

This shell can only see its own host, 127.0.0.1. That is not a limitation to work
around, it is the agreement: scanning a machine you do not own is the difference
between a researcher and a liability.

The real nmap on your machine has no such guard. It will scan anything you point it at, which is exactly why the question has to live in you.

The rest of this page walks the ladder as four rungs, each carried to where it lands. Am I allowed. What is alive. What each answer is. What comes next.

Rung one. Am I allowed. Draw the boundary

The question is not a feeling. It is a range, and two commands draw it before any scan runs:

$ ip -br addr
lo               UNKNOWN        127.0.0.1/8 ::1/128 
eth0@if67        UP             192.168.1.4/24 

$ ip route
default via 192.168.1.1 dev eth0 
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.4

That output is one real machine on one real /24, pasted as it printed. It is not your machine, so your numbers will differ, and knowing your numbers is this rung.

Read it in three passes. Which interface is which. The loopback line is the machine talking to itself, and it never leaves the machine. The line that is UP with a private address is your real door to the network. If yours says wlan0 it is wireless. On a desktop it is eth0 or a longer name the driver chose, like enp3s0. The at sign in eth0@if67 is this particular machine telling you it lives inside a container, eth0 being the name inside and 67 the number of the wire on the host, and it is the kind of name trivia that identifies a lab seat. A line that is DOWN, or a bridge with a name like docker0, is a door to a network the machine built for itself, not a door to the house.

Which range is yours. The route table carries both numbers that matter. The default via line names your gateway, the router you are behind, and its admin page lives at that address or one digit off it. The 192.168.1.0/24 line is the range you are standing in, and the src on the end of it is the machine's own address inside that range, which is the two lines agreeing with each other.

Why the count matters. A home range is usually a /24. Three names for the same thing: a /24, a 255.255.255.0 mask, 254 usable addresses. Every one of them belongs to somebody. Yours, your router, a printer, a television. The sweep is lawful. What you do with each answer is where judgment starts.

This rung ends with you able to say your own boundary out loud. My range is this, my gateway is that, this sweep covers these 254 addresses. If you cannot say it, you are not ready to scan it, because a scan of a range you misread is a scan of somebody else's house.

One line if your machine is not Linux. The ip command is Linux. On macOS and the BSDs the pair is ifconfig and netstat -rn, which answer the same two questions, where you sit and who the gateway is.

Rung two. What is alive. The sweep

nmap -sn 192.168.1.0/24

A -sn sweep is for YOUR network, not this one.

That is the interesting half of lesson 004. Run it at home:

  nmap -sn 192.168.1.0/24

and identify every answer before you decide what any of them are. Most surprises
are a television, a printer, or something you plugged in three years ago.

-sn means no port scan. Ping sweep only. It answers one question: what is alive. Run it against your own range and read the list before touching a single host.

On your machine the sweep answers like this. One real run against one real /24, a lab network built for this lesson, pasted as it printed:

$ nmap -n -sn 192.168.1.0/24
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-09-23 20:02 UTC
Nmap scan report for 192.168.1.1
Host is up (0.000039s latency).
MAC Address: 0A:CA:6B:46:C8:0B (Unknown)
Nmap scan report for 192.168.1.2
Host is up (0.0000090s latency).
MAC Address: 12:EF:EB:67:6D:C0 (Unknown)
Nmap scan report for 192.168.1.3
Host is up (0.000015s latency).
MAC Address: 42:A1:5D:D4:34:03 (Unknown)
Nmap scan report for 192.168.1.4
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 1.95 seconds

Read the sweep the way you read any answer, line by line. Each host gets two or three lines. The address is who. The latency is how far. The MAC line is the hardware's own name for itself, and beside it nmap prints the vendor it looked up from the first three bytes, which is your first clue about what the device is. In this lab every vendor reads Unknown because container addresses are randomized at creation, and a real television or printer usually resolves to a name you recognize.

One line in that output is different from the others. The last host, 192.168.1.4, prints Host is up. and nothing else. No latency, no MAC. That is the seat the sweep ran from. It is up because you are asking. The latency is blank because nmap never sent a packet to measure. There is no MAC line because you cannot ask ARP for your own address. Learn this line on sight, because your own address is the one you will otherwise chase.

Two states confuse people, and the lab was built to hold both. A host that answers ping, and a host that ignores it:

$ ping -c 2 192.168.1.2
2 packets transmitted, 2 received, 0% packet loss, time 1049ms
rtt min/avg/max/mdev = 0.037/0.044/0.052/0.007 ms

$ ping -c 2 192.168.1.3
2 packets transmitted, 0 received, 100% packet loss, time 1046ms

Same network. Same sweep. One host answered and one ignored, and both are on the list. The quiet host was built that way on purpose, a one line firewall rule that drops ping, and plenty of real devices and hardened servers do the same without being asked. The sweep still found it. That is the reason a sweep finds devices a port scan would miss. On your own segment nmap does not need ping to work. It asks ARP who has each address, the same question your router asks, and answering ARP is not optional for a host that wants to talk, because without an ARP entry nothing reaches it. The ping refuses, the ARP answers, and the host is on your list. One sweep, two kinds of alive, both found, and the scanner that trusts ping alone would have missed one of them.

Rung three. What each answer is. Name every host

The Try it at the bottom says to name every host, and until now the method was never handed over. Here it is, four ways.

The vendor line. The first three bytes of a MAC are an assignment, a maker who bought that prefix, and nmap prints the name it found. A television reads Samsung or LG. A printer reads HP or Brother or Canon. A laptop often reads the maker of its wireless card rather than the laptop brand, which is a fact about who makes the chips rather than who makes the box. On your own segment, a range where ARP answers, you get this line for every host but yourself. On a routed segment, beyond your gateway, you do not, and the line is absent. That absence is not a refusal. It is distance.

The router's admin page. The gateway from rung one is the router, its admin page lives at that address or one digit off it, and its DHCP leases page lists every device that ever took an address, often with hostnames. Read it as a census, not a verdict, because the television you forgot is on that page too.

The sticker. Printers print their own network summary page, and the MAC is on the label underneath more devices than you would think.

The house. The thing plugged in three years ago is the one method no tool replaces. Walk it. Count the sockets. A surprise on your own network is an unidentified device, not an intruder, until you have checked these four.

Two habits from Field Work carry straight over. Identify every answer, because a surprise on your own network is an unidentified device, not an intruder. And count from the machine, never from memory, because the television you forgot is the host you will panic about at midnight.

Rung four. The handoff

What is open and what is running are the next rungs, and they are taught elsewhere in this tier. Lesson 016 runs the full scan and owns what is open. Lesson 017 asks each door what it is and owns what is running. A port scan needs a target list, and the list you just built is the one it uses. Lesson 033 hands you a target worth pointing any of this at, one built to be broken.

This lesson owns the order, not the whole climb.

The order is the lesson. Am I allowed. What is alive. What is open. What is running. In that order, every time, and the first question is the only one you cannot answer with a tool.

Try it

Draw the boundary. Run the two boundary commands on your own machine, find your range and your gateway, and say the boundary out loud before any scan runs.
Run the sweep on your own range. Count the answers. Find the quiet host if there is one, the address that ignores ping and still appears.
Name every host. The vendor line, the router's DHCP leases, the sticker, and the house. The difference between this week's list and last week's is your network's heartbeat, and the week something new appears is the week you wanted to know.

One line on the noise you are about to make. A ping sweep on your own segment leaves ARP and ICMP and nothing else. No logs on any host that does not keep them, no state left anywhere, and the router logs that do exist will show your own address asking who lives here. Saying what a scan leaves behind is part of teaching it.