# Network Reconnaissance Chapter 3 · Fall 2026 Note: Speaker notes start with "Note:". Press S to open the speaker view. --- ## Passive vs active - **Passive:** ask third parties (DNS, CT logs, job posts) - **Active:** send packets to the target - Active is sharper, and it gets logged Note: Ask the class which one leaves evidence on the target. --- ## Scope first > Only scan systems you have written permission to test. ```bash nmap -sS -sV -T3 -oA scans/lab-net 10.10.20.0/24 ``` --- ## Port states ```mermaid sequenceDiagram participant S as Scanner participant T as Target port S->>T: SYN alt open T-->>S: SYN/ACK else closed T-->>S: RST else filtered Note over S,T: no reply end ```
← Chapter
Ops
Term
Solar
Neon