A penetration tester, who is not on the client's network. is using Nmap to scan the network for hosts that are in scope. The penetration tester is not receiving any response on the command: nmap…

The -Pn flag skips ICMP-based ping host discovery and treats every target address as alive, which is essential when firewalls block ICMP packets from external networks. The -sT flag performs a full TCP three-way handshake connect scan that works reliably from outside the target network without requiring raw socket privileges. Together they resolve the most common causes of no response when scanning from a remote, untrusted network.

The -sF (FIN scan) is often dropped by stateful firewalls and the -p flag requires a port number argument, making this command syntactically invalid and unreliable from an external position.

The -sV flag adds service version detection and -oA saves output in multiple formats, but neither flag addresses the host discovery blockage that is causing the lack of response.

The -T4 flag sets an aggressive timing template to increase scan speed, but it does not resolve the underlying issue of ICMP-based discovery being filtered by external firewalls.