Enumeration turns a network into a list of observed hosts, services, and responses. Before sending traffic, write down what is in scope, what is excluded, the testing window, allowed source addresses, rate limits, and who to contact if something looks wrong. NIST’s SP 800-115 treats planning, testing, analysis, and mitigation as parts of one assessment.
Start with the vantage point. Confirm the route and source address, then use an approved method to identify responding hosts. Follow with a narrow service check. For each observation, record the protocol, port, time, tool version, relevant options, response, and uncertainty. Expand the test only when the result and the rules of engagement support it.
A port that replies is open from that observation point at that time. A timeout does not prove the service is absent. Firewalls, routing, packet loss, rate limiting, and host behavior can all change what the scanner sees. Repeat the probe when the distinction matters.
Banners are clues. A service may identify itself with an old or generic version string, so keep the exact response and corroborate it before attaching a product claim. A certificate or DNS name can suggest another host, but it does not add that host to the approved scope.
The simple sequence in the Research diagram—authorize, observe, verify, report—keeps the test legible. OWASP’s Web Security Testing Guide provides a broader set of web test scenarios. For any real assessment, the signed scope and rules of engagement determine what is allowed.