Network mapping provides a security testing team with a blueprint of the organization. Which of the following steps is NOT a part of manual network mapping?

Collecting employee information via OSINT and public records is a standard manual reconnaissance step used to identify key personnel and potential attack vectors.

Gathering private and public IP addresses through manual DNS queries, WHOIS lookups, and subnet enumeration is a core manual network mapping activity.

Performing Neotracerouting uses NeoTrace, an automated graphical route-tracing application, which makes it a tool-assisted activity rather than a manual network mapping step. Manual network mapping is defined by techniques that rely on human analysis and judgment - such as gathering open-source employee data, enumerating IP ranges from WHOIS and DNS records, and manually banner-grabbing service headers - none of which require dedicated automated path-tracing software.

Banner grabbing - manually connecting to open TCP ports to retrieve service version strings - is a classic manual technique for identifying hosts and services on a network.