Nmap -sn: scan or no scan? The `nmap` man page has this to say about the `-sn` parameter: -sn (No port scan) . This option tells Nmap not to do a port scan after host discovery, and only print out the available hosts that responded to the scan. The first half of the sentence mentions that there is no scan, but the second half says that there is a scan. Is there a different type of scan than a port scan that the second half is referring to? A host-discovery scan perhaps (guessing from the little that I know about `nmap`)?

You're right that the documentation is worded poorly. `-sn` means "skip the port scan phase," and was previously available as `-sP`, with the mnemonic "Ping scan".

Nmap scans happen in phases. These are:

1. Name resolution
2. NSE script pre-scan phase
3. Host discovery ("ping" scan, but not necessarily ICMP Echo request)
4. Parallel reverse name resolution
5. Port or Protocol scan
6. Service version detection
7. OS fingerprinting
8. Traceroute
9. NSE portrule and hostrule script scanning phase
10. NSE post-scan phase



Note that not all these phases get executed in every scan, depending on the arguments. This scan:


nmap -sn scanme.nmap.org


will run phases 1, 3, and 4.

EDIT: I corrected the documentation you referred to in r33790:

> This option tells Nmap not to do a port scan after host discovery, and only print out the available hosts that responded to the **host discovery probes**.