nmap

The most effective host discovery method is to use ICMP echo requests.
This scanning method works only if the firewalls of the hosts allow it.
nmap 10.129.2.0/24 -sn -oA tnet | grep for | cut -d" " -f5
Scanning Options 	Description
10.129.2.0/24 	Target network range.
-sn 			Disables port scanning.
-oA tnet 		Stores the results in all formats starting with the name 'tnet'.
-iL hosts.lst   Performs defined scans against targets in provided 'hosts.lst' list.


nmap 10.129.2.18 -sn -oA host -PE --packet-trace
Scanning Options 	Description
10.129.2.18 	    Performs defined scans against the target.
-sn 	            Disables port scanning.
-oA host 	        Stores the results in all formats starting with the name 'host'.
-PE 	            Performs the ping scan by using 'ICMP Echo requests' against the target.
--packet-trace      Shows all packets sent and received

Nmap - Trace the Packets (clear view of the SYN scan)
sudo nmap 10.129.2.28 -p 21 --packet-trace -Pn -n --disable-arp-ping #sudo or -sS
Scanning Options 	Description
10.129.2.28 	    Scans the specified target.
-p 21 	            Scans only the specified port.
--packet-trace 	    Shows all packets sent and received.
-n 	                Disables DNS resolution.
--disable-arp-ping 	Disables ARP ping.
-Pn                 Disables ICMP Echo requests.
--reason 	        Displays the reason a port is in a particular state.


sudo nmap 10.129.2.28 -p 443 --packet-trace --disable-arp-ping -Pn -n --reason -sT
(-sT) - is the most accurate way to determine the state of a port, and it is also the most stealthy. Unlike other types of scans, such as the SYN scan, the Connect scan does not leave any unfinished connections or unsent packets on the target host, which makes it less likely to be detected by intrusion detection systems (IDS) or intrusion prevention systems (IPS). It is useful when we want to map the network and don't want to disturb the services running behind it, thus causing a minimal impact and sometimes considered a more polite scan method. It is also useful when the target host has a personal firewall that drops incoming packets but allows outgoing packets. However, it is important to note that the Connect scan is slower than other types of scans because it requires the scanner to wait for a response from the target after each packet it sends, which could take some time if the target is busy or unresponsive.
It is also useful when the target host has a personal firewall that drops incoming packets but allows outgoing packets. In this case, a Connect scan can bypass the firewall and accurately determine the state of the target ports.