1. Information gathering 2. Determining the network range 3. Identifying active machines 4. Finding open ports and access points 5. OS fingerprinting 6. Fingerprinting services 7. Mapping the network