You already know how to check if a machine is online. Now it's time to learn what that machine is doing. Advanced reconnaissance is about moving from passive observation to active intelligence gathering. We're going to use Nmap, a powerful network scanner, to map our target's attack surface in detail.

Our first step is to choose the right tool for the job. Not all scans are created equal. The most basic scan is a TCP Connect scan. It completes the full three-way handshake ($SYN$, $SYN-ACK$, $ACK$) with the target port. It's reliable and doesn't require special privileges to run, but it's also very noisy. Any decent logging system will record the connection attempt, making you easy to spot.

For a quieter approach, we use a SYN scan, sometimes called a half-open scan. This scan sends a $SYN$ packet, just like the Connect scan. But when the target replies with a $SYN-ACK$ (indicating the port is open), the scanner sends a $RST$ (reset) packet instead of the final $ACK$. The connection is never fully established. Because the application layer is never reached, this method is far less likely to be logged by the target system.

Here's a quick comparison:

Knowing a port is open is useful, but knowing what's running on that port is critical. Is port 80 running Apache 2.4.41 or Microsoft IIS 10.0? The answer determines your next move. Service version detection tells us exactly what software and version is listening on an open port. We can do this in Nmap with the -sV flag.

Beyond the service, we need to identify the underlying operating system. Every OS implements the TCP/IP stack slightly differently. OS fingerprinting works by sending a series of specifically crafted probes to the target and analysing the responses. Tiny variations in things like TCP window sizes, packet header options, and ICMP responses can reveal the OS with surprising accuracy. Nmap's -O flag enables this feature.

Sometimes, even a SYN scan isn't stealthy enough. An Intrusion Detection System (IDS) might flag a burst of SYN packets from a single IP. This is where an idle scan comes in. It's a truly blind scanning technique that uses a third-party, idle machine (a 'zombie') to send the packets. Your IP address never directly communicates with the target, making you effectively invisible.

The real power of Nmap, however, lies in its scripting engine. The Nmap Scripting Engine (NSE) allows users to write (and use pre-written) scripts to automate a wide variety of networking tasks. These scripts can detect specific vulnerabilities, perform more advanced enumeration, or even conduct basic exploitation. Using the default scripts (-sC) is a great way to expand your reconnaissance.

This single command will perform a stealth scan of an entire subnet, run default scripts to find common issues, attempt to identify the OS of each host, and save the results for later analysis. This is the foundation of effective, automated reconnaissance.

Time to test what you've learned.

These techniques move beyond simply finding open doors; they involve understanding the locks, the frame, and the material the door is made of. Mastering them is a fundamental step toward becoming an effective ethical hacker.