Which is the first step followed by Vulnerability Scanners for scanning a network?

OS detection is a later stage in vulnerability scanning, occurring after a host is confirmed alive and its open ports are identified, as it relies on service banners and network responses.

Firewall detection is typically integrated into the port scanning or service fingerprinting phases, rather than being the very first step before host liveness is established.

TCP/UDP port scanning is a subsequent step that follows host discovery, as it is only efficient and logical to scan ports on a host that has already been identified as alive.

Before any deeper analysis, a vulnerability scanner must first determine if a target host is active and reachable on the network through a process known as host discovery or host probing. This initial step, often involving ICMP echo requests or ARP pings, prevents the scanner from expending resources on offline or non-existent systems.