What is active reconnaissance?
Active reconnaissance is information gathering that interacts directly with the target's own systems. The tester sends traffic to the target and learns from the replies: which hosts are up, which ports are listening, what software answers and which version it reports. In most engagements it follows passive reconnaissance, and it is the point at which the target can start to notice.
Common active techniques
- Ping sweeps to find which addresses in a range respond
- Port scans to find listening TCP and UDP services
- Banner grabbing to read the product and version a service announces
- Vulnerability scans against the hosts that were found
- Zone transfer requests sent to the organization's own DNS servers
- Enumeration of shares, user names or web directories on a reachable host
What defenders see
Probes leave evidence. A firewall or IDS log often shows one source touching many ports or many hosts within seconds, for example one outside address reaching ports 21, 22, 23, 80, 443, 445 and 3389 on a single server in under two seconds, and SIEM rules commonly alert on that pattern. Slowing a scan down makes it harder to spot but does not make it passive. Probing can also cause harm: aggressive scanning sometimes crashes fragile devices such as older printers or industrial controllers, which is why tests limit scanning to agreed ranges and time windows.
Why testers still use it
Public sources suggest what might exist; direct probing confirms what is really there. A job ad may mention a VPN product, but only a scan shows that a VPN portal is listening on a particular address and which version it reports. The exploitation phase needs that precision, so active reconnaissance happens only after written authorization and inside the rules of engagement.
Active vs. passive reconnaissance
The dividing line is contact. Passive reconnaissance uses public and third-party sources, sends nothing to the target and is very hard to detect. Active reconnaissance sends traffic to the target, gives more precise answers and can show up in logs. Vulnerability scanning counts as active reconnaissance when a tester uses it to find targets, and it is also a routine defensive control in its own right.
Active reconnaissance on the CompTIA Security+ exam
Under SY0-801 objective 5.5, reconnaissance is either passive or active. Scenario wording such as scanning, probing, ping sweeps, banner grabbing or connecting to the target's servers points to active reconnaissance. The classic trap is a slow or stealthy scan offered as passive; any traffic sent to the target is active. Distractors include passive reconnaissance and OSINT, which describe public research, and vulnerability scanning as an ongoing defensive program. A log showing many ports hit from one address in seconds describes active reconnaissance, most likely a port scan.