Which is the first step followed by Vulnerability Scanners for scanning a network?

TCP/UDP port scanning is the second major phase, executed only after the host is confirmed alive.

Firewall detection occurs after port scanning reveals filtered or blocked ports, placing it later in the process.

OS detection depends on responses from open ports and running services, making it a downstream activity.

Before port scanning, firewall detection, or OS fingerprinting can take place, the scanner must verify the remote host is alive and responsive, typically via ICMP echo requests or TCP probes. Attempting any subsequent phase against an unreachable host wastes resources and yields no data. Host discovery is therefore the mandatory first step in every vulnerability scanning methodology.