Ethical Hacking: Techniques, Tools, and Countermeasures, 4th Edition

Determining Address Ranges of Networks

The first step in active reconnaissance is preparation—specifically, gathering information about the range of Internet Protocol (IP) addresses used by the target. When the attacker is armed with this information, the port scanning process can become much more accurate and effective because only the IP addresses of the intended victim(s) will be scanned. Not having the appropriate network range can result in an inaccurate or ineffective scan that may even inadvertently trigger detective measures. Active reconnaissance is much noisier than passive reconnaissance, so it is more likely to alert targets of suspicious activity.

When obtaining information about the network ranges, there are two primary options: ...