Which is the first step followed by Vulnerability Scanners for scanning a network?

TCP/UDP port scanning occurs after host discovery, not as the first step, because scanning ports on an unconfirmed host is inefficient.

Firewall detection is a later-stage technique performed after the host is known to be alive and initial port data is gathered.

OS detection relies on responses from open or closed ports and therefore cannot occur before the host is confirmed alive and ports are identified.

Before a vulnerability scanner can perform any meaningful enumeration, it must confirm the target host is alive, typically via ICMP echo requests or TCP/UDP probes. Only after a live host is confirmed does the scanner proceed to port scanning, OS detection, and service enumeration. Skipping this step would cause the scanner to waste cycles probing unreachable addresses.