If none of these host discovery techniques are chosen, Nmap uses a default which is equivalent to the -PE -PS443 -PA80 -PP arguments for Windows or privileged (root) Unix users. Attentive readers know that this means an ICMP echo request, a TCP SYN packet, a TCP ACK packet, and an ICMP timestamp request are sent to each machine. An exception to this is that an ARP scan is used for any targets which are on a local ethernet network. For unprivileged Unix shell users, the default is equivalent to -PS80,443 (a TCP connect call against ports 80 and 443 of the target hosts).