An attacker engages in scanning activity to find vulnerable network nodes, such as hosts, devices, or routes. Attackers usually perform this type of network reconnaissance during the early stages of attack against an external network. Many types of scanning utilities are typically employed, including ICMP tools, network mappers, port scanners, and route testing utilities such as traceroute.