TechKnowSurge
TechKnowSurge Catalog Videos Network Reconnaissance
VideoSecurityFree

Network Reconnaissance

Network discovery and enumeration techniques range from passive methods like packet sniffing and ARP monitoring to active approaches such as network scanning, packet crafting, and banner grabbing. Understanding when and how to apply each method is essential for effective reconnaissance while avoiding detection.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Network reconnaissance is the process of mapping and understanding a target network's structure, devices, and services, and it forms a critical early phase of any adversarial operation. The approach taken depends heavily on the risk of detection: passive reconnaissance, which involves observing existing network traffic without generating new activity, is typically the starting point because it avoids triggering intrusion detection and prevention systems. Techniques such as packet sniffing allow an attacker to silently monitor traffic, extract ARP broadcasts to identify active hosts, and observe API request-response patterns that reveal what services and applications are running on internal servers. Operational technology environments — including industrial control systems and robotics infrastructure — are particularly valuable targets during this phase, as they are often under-patched and inadequately secured compared to traditional IT assets. When passive methods yield insufficient intelligence, active reconnaissance techniques become necessary despite the elevated risk of detection. Network scanning probes for live IP addresses and open ports, while packet crafting goes a step further by constructing and transmitting custom packets to observe how devices respond. Even a failed login attempt can provide useful data, as many systems return banners or error messages that disclose device type, operating system, and software version — a technique known as banner grabbing. Together, passive and active reconnaissance methods build a detailed picture of the target environment, identifying both the attack surface and the most viable entry points.

What you'll learn

Key terms

Packet
A unit of data formatted for transmission over a network, containing a header, payload, and sometimes a trailer.
Address Resolution Protocol
ARP
A protocol used to map an IP address to a physical MAC address on a local network.
Intrusion Detection System
IDS
A system that monitors network or system activities for malicious behavior and generates alerts.
Intrusion Prevention System
IPS
A system that monitors network traffic and actively blocks detected threats in real time.
Port Scanning
A technique used to discover open ports and services available on a networked device.
Passive Reconnaissance
An intelligence-gathering phase in which an attacker collects information about a target using only publicly available sources — such as WHOIS records, job postings, and social media — without directly interacting with the target's systems.
Active Reconnaissance
Intelligence gathering that involves direct interaction with a target system, such as port scanning or vulnerability scanning, which may trigger alerts.
Packet Sniffing
The practice of capturing and analyzing network packets as they travel across a network, used by attackers to intercept unencrypted data.
Packet Crafting
The deliberate construction and transmission of custom network packets to probe hosts and elicit responses that reveal device type, version, or open services.
Banner Grabbing
An active reconnaissance technique that captures the response message returned by a service to identify the software type and version running on a host.

Topics

Network Reconnaissance Packet Sniffing Network Scanning Banner Grabbing Packet Crafting Arp Monitoring Ethical Hacking

Transcript

Active Versus Passive Reconnaissance

So how do we do this network discovery, this network reconnaissance? How do we discover how this network is set up and do enumeration on it?

Here's where that active and passive reconnaissance really comes into play. If we just start doing active reconnaissance — that is, we have infected this computer and now we start scanning the network to see what everything is on this network and just scan everything — an intrusion detection system or intrusion protection system is going to discover that type of activity. They're going to see things like scans happening on this network.

So we are probably going to carry out more passive reconnaissance, at least at first, and we're going to just monitor things and see what comes to us initially. That would be what passive reconnaissance is, and it wouldn't alert anybody as much about what we're trying to do on this network.

What Passive Reconnaissance Turns Up

One of the ways we could do that is just through packet sniffing, listening to the traffic that's going across, and that can tell us a lot about what's happening on our network.

One of the things that we would hear as traffic passes this network is all of the ARP requests that are going on — the address resolution protocol. Address resolution protocol is when one machine on the network wants to talk to another machine, or even through something like the default gateway or firewall. As these are talking back and forth, that traffic gets broadcast all around. So if you're sitting on the network, you could hear a lot of what's happening and who is on this network, and discover a lot of things.

Another thing that we could find is some sort of operational technology protocols. These are things like industrial control systems, maybe operating things like robots. These can be great targets, because a lot of times they're not as secure. They have security holes that we can leverage, and they often get overlooked in things like patching and updating.

With all this network traffic, we're also going to discover the different hosts on the network — hosts that we might see like servers or other machines on the network that we could leverage.

If two machines are talking with each other, they also might use some sort of API requests and responses. If we see requests and responses for some specific API, that lets us know what kind of services could be running on this server, not to mention that that service also might have some sort of vulnerabilities that we could leverage.

Stepping Up to Active Reconnaissance

If we are on this network, some of that traffic might not come to us, in which case we might want to step it up and go to active reconnaissance, where we're doing some sort of network scanning and scanning for devices on this network.

One thing we could be doing is packet crafting. Scanning just allows us to scan for open IP addresses or open ports that are on this network, but packet crafting would actually be to put together a packet and send it out on this network, so that we can see what kind of responses we get from it.

Even the act of attempting to log into a machine could give me valuable information. Even if I know that I'm not going to be able to successfully get onto this machine, just the attempt gives me some sort of feedback. There are many things that give you some sort of banner, that send back a banner, send back some sort of message, and it has a certain response time with that, and it gives us details into what this device is and what version it is running, based off of that banner that it sends back. We call that banner grabbing.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →