In accordance with one aspect of the embodiments of this invention there is a method to operate a network mapping tool. The method includes performing a network mapping operation over a first set of ports to generate a list of hosts that are found to be alive; performing a sequential scan on only those hosts in the list to detect the operating system of each host in the list; and performing a parallel port scan to detect characteristics of only those hosts in the list. The characteristics can include an identification of at least applications and services running on the hosts in the list. The second set of ports can be a full set of ports.