An ethical hacker is preparing to scan a network to identify live systems. To increase the efficiency and accuracy of his scans, he is considering several different host discovery techniques. He…

ICMP ECHO ping sweeps are often blocked by restrictive firewalls, making them ineffective for discovering live hosts behind such firewalls.

ICMP Timestamp pings are also a type of ICMP request and are susceptible to being blocked by restrictive firewalls, similar to ICMP ECHO.

TCP SYN pings work at Layer 3/4 and can be blocked by stateful firewalls, especially if they are configured to drop unsolicited SYN packets or deny access to common ports.

An ARP (Address Resolution Protocol) ping scan works at Layer 2 within the local network segment, bypassing many restrictive firewalls that operate at Layer 3 or higher. Since it directly queries for MAC addresses corresponding to IP addresses on the local LAN, it is highly accurate for discovering active hosts within the private address range, even with unused IPs or blocked ICMP/TCP traffic.