This article explains how the RN150 appliance uses Nmap during scans. It covers what happens during the discovery stage, when Nmap runs (including performance phase distinctions), and which ports and protocols are checked. This helps you understand how devices are identified and how scan behavior affects your results.

How RN150 uses Nmap

Discovery stage overview

When you start a scan, RN150 performs an initial discovery stage to find active hosts and determine how to connect to them.

This process includes:

• ICMP sweep
  RN150 scans the specified subnets to identify active hosts.
• Selective port scan
  For each responding IP address, RN150 checks specific ports tied to supported credential methods (e.g., WMI, SSH, SNMP, VMware API).
• Credential authentication
  If RN150 finds an open port, it attempts to authenticate using the credentials you provided.

Ports and protocols checked

RN150 scans only the ports required for supported access methods:

When Nmap scans run

• Nmap scanning runs every time you initiate a scan, even for previously scanned IPs or subnets. This ensures RN150 detects any changes in the environment.
• Nmap scanning runs only during the discovery stage.

Performance stage behavior

During the performance stage, RN150 does not perform Nmap scans. Instead, it collects system metrics such as:

• CPU usage
• Memory usage
• Disk activity
• Network usage

It gathers this data using credential-based methods like WMI, SSH, and SNMP.