[-An0n]

Am using Nmap 5 on an isolated network running the host discovery options
like ICMP Echo (-PE), Timestamp (-PP), Netmask Request Discovery (-PM)
alongwith the -v -n options but the result is always an ARP ping (-sP) of the
target & Syn Stealth scan (-sS) by default which is not what I was expecting.
Am I missing anything??? Heres the complete command that I type:

nmap -PE -v -n 192.168.11.3

or

nmap -PP -v -n 192.168.11.3

or

nmap -PM -v -n 192.168.11.3

[(Viz0n)]

This is because you're scanning a host that is on your same network.

Note that ARP discovery (-PR) is done by default against targets on a local ethernet network even if you specify other -P* options, because it is almost always faster and more effective.

[(MaXe)]

Viz0n, on Oct 8 2009, 09:20 PM, said:

Note that ARP discovery (-PR) is done by default against targets on a local ethernet network even if you specify other -P* options, because it is almost always faster and more effective.

In some cases where the ICMP protocol has been disabled on some devices, ARP (requests) can be quite useful which is also a reason why it is executed by default.

This post has been edited by MaXe: 21 January 2010 - 08:36 AM