During footprinting, which tool is most appropriate for discovering open ports and services running on a target system?