Nmap

Network host discovery: Nmap identifies which hosts are live on a network using a variety of probe techniques (ICMP, TCP, ARP, and more), producing an inventory of active systems as the foundation for further scanning.

Port scanning (TCP, UDP): Nmap determines which ports are open, closed, or filtered on target hosts across both TCP and UDP, revealing the services exposed and the network-facing attack surface.

Service and version detection: By probing open ports and analyzing responses, Nmap identifies the specific service and software version running on each port, giving precise insight into what each host is offering.

Operating system detection / fingerprinting: Nmap analyzes subtle characteristics of a host's network stack responses to infer its operating system and device type, aiding identification and targeting.

Multiple scan techniques (SYN, connect, FIN, Xmas, etc.): Nmap supports many scan methods, from stealthy half-open SYN scans to full connect scans and various flag-based scans, letting the operator choose techniques suited to the target and to evasion needs.