本节书摘来自异步社区《Nmap渗透测试指南》一书中的第2章2.8节ICMP Ping Types扫描，作者 商广明,更多章节内容可以访问云栖社区“异步社区”公众号查看。
2.8 ICMP Ping Types扫描
表2.7所示为本章节所需Nmap命令表，表中加粗命令为本小节所需命令——ICMP Ping Types扫描。
使用-PE；-PP；-PM选项可以进行ICMP Ping Types扫描。ICMP（Internet Control Message Protocol）是Internet控制报文协议。它是TCP/IP协议族的一个子协议，用于在IP主机、路由器之间传递控制消息。控制消息是指网络通不通、主机是否可达、路由是否可用等网络本身的消息。这些控制消息虽然并不传输用户数据，但是对于用户数据的传递起着重要的作用
Nmap发送一个ICMP type 8（回声请求）报文到目标IP地址，从运行的主机得到一个type 0（回声响应）报文。-PE选项简单地来说是通过向目标发送ICMP Echo数据包来探测目标主机是否在线，正因为许多主机的防火墙会禁止这些报文，所以仅仅ICMP扫描对于互联网上的目标通常是不够的。但对于系统管理员监视一个内部网络，它们可能是实际有效的途径。使用-PE选项打开该回声请求功能。-PP选项是ICMP时间戳Ping扫描，虽然大多数的防火墙配置不允许ICMP Echo请求，但由于配置不当可能回复ICMP时间戳请求，所以可以使用ICMP时间戳来确定目标主机是否存活。-PM选项可以进行ICMP地址掩码Ping扫描。这种扫描方式会试图用备选的ICMP等级Ping指定主机，通常有不错的穿透防火墙的效果。
（1）使用ICMP Echo扫描方式
root@Wing:~# nmap -PE -v 192.168.121.1
Starting Nmap 6.47 ( http://nmap.org ) at 2015-06-27 21:22 CST
Initiating Ping Scan at 21:22
Scanning 192.168.121.1 [1 port]
Completed Ping Scan at 21:22, 0.00s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 21:22
Completed Parallel DNS resolution of 1 host. at 21:22, 0.01s elapsed
Initiating SYN Stealth Scan at 21:22
Scanning 192.168.121.1 [1000 ports]
Discovered open port 139/tcp on 192.168.121.1
Discovered open port 135/tcp on 192.168.121.1
Discovered open port 445/tcp on 192.168.121.1
Discovered open port 49159/tcp on 192.168.121.1
Discovered open port 49152/tcp on 192.168.121.1
Discovered open port 843/tcp on 192.168.121.1
Discovered open port 912/tcp on 192.168.121.1
Increasing send delay for 192.168.121.1 from 0 to 5 due to 119 out of 395 dropped probes since last increase.
Discovered open port 49155/tcp on 192.168.121.1
Discovered open port 7000/tcp on 192.168.121.1
Discovered open port 902/tcp on 192.168.121.1
Discovered open port 8000/tcp on 192.168.121.1
Stats: 0:02:15 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 99.99% done; ETC: 21:25 (0:00:00 remaining)
Stats: 0:02:16 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 99.99% done; ETC: 21:25 (0:00:00 remaining)
Discovered open port 49153/tcp on 192.168.121.1
Completed SYN Stealth Scan at 21:25, 148.61s elapsed (1000 total ports)
Nmap scan report for 192.168.121.1
Host is up (1.0s latency).
Not shown: 987 closed ports
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
514/tcp filtered shell
843/tcp open unknown
902/tcp open iss-realsecure
912/tcp open apex-mesh
7000/tcp open afs3-fileserver
8000/tcp open http-alt
49152/tcp open unknown
49153/tcp open unknown
49155/tcp open unknown
49159/tcp open unknown
Nmap done: 1 IP address (1 host up) scanned in 148.68 seconds
Raw packets sent: 1744 (76.720KB) | Rcvd: 1017 (40.716KB)
root@Wing:~#
（2）使用ICMP时间戳Ping扫描
root@Wing:~# nmap -PP -v 163.com
Starting Nmap 6.47 ( http://nmap.org ) at 2015-06-27 21:24 CST
Initiating Ping Scan at 21:24
Scanning 163.com (123.58.180.8) [1 port]
Completed Ping Scan at 21:24, 2.01s elapsed (1 total hosts)
Nmap scan report for 163.com (123.58.180.8) [host down]
Other addresses for 163.com (not scanned): 123.58.180.7
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 2.08 seconds
Raw packets sent: 2 (80B) | Rcvd: 0 (0B)
root@Wing:~#
（3）使用ICMP地址掩码Ping扫描
root@Wing:~# nmap -PM -v 192.168.121.1
Starting Nmap 6.47 ( http://nmap.org ) at 2015-06-27 21:27 CST
Initiating Ping Scan at 21:27
Scanning 192.168.121.1 [1 port]
Completed Ping Scan at 21:27, 2.01s elapsed (1 total hosts)
Nmap scan report for 192.168.121.1 [host down]
Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
Nmap done: 1 IP address (0 hosts up) scanned in 2.05 seconds
Raw packets sent: 2 (64B) | Rcvd: 0 (0B)
root@Wing:~#
可以看到，不同的扫描方式穿过不同的防火墙时有着不同的结果。
