Skip to content
HackIndex logo

HackIndex

ICMP Host Discovery and Ping Sweeps

5 min read Mar 30, 2026

ICMP echo requests are the fastest way to identify live hosts on a network. A ping sweep sends an ICMP echo request to each address in a range and records which ones respond. The results tell you what is alive before spending time on port scanning.

ICMP is blocked on some hardened networks and cloud environments — no response does not always mean the host is down. Combine with TCP-based discovery when ICMP gives incomplete results.

Nmap Ping Sweep

Nmap's -sn flag performs host discovery without port scanning. By default it sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and an ICMP timestamp request.

┌──(kali㉿kali)-[~]
└─$ nmap -sn $TARGET_IP/24 
Starting Nmap 7.94
Nmap scan report for 10.10.10.1
Host is up (0.0023s latency).
Nmap scan report for 10.10.10.5
Host is up (0.0041s latency).
Nmap scan report for 10.10.10.20
Host is up (0.0089s latency).
Nmap done: 256 IP addresses (3 hosts up) scanned in 2.41 seconds
Explain command
-sn Ping scan only; disables port scanning, performs host discovery.
$TARGET_IP/24 Target subnet in CIDR notation, scanning all 256 addresses in the range.

For ICMP only, without the TCP fallback:

┌──(kali㉿kali)-[~]
└─$ nmap -sn -PE $TARGET_IP/24
Explain command
-sn Ping scan only; disables port scanning, host discovery only.
-PE Uses ICMP echo request packets for host discovery.
$TARGET_IP/24 Target subnet derived from variable, covering 256 addresses (/24 CIDR).

-PE restricts discovery to ICMP echo requests. Faster but misses hosts that block ICMP.

Output live hosts only — useful for piping into further scans:

┌──(kali㉿kali)-[~]
└─$ nmap -sn $TARGET_IP/24 | grep "Nmap scan report" | awk '{print $NF}'
Explain command
-sn Ping scan only; disables port scanning, host discovery only.
$TARGET_IP/24 Target subnet derived from variable, scanned as a /24 CIDR range.

fping — Fast Parallel Ping

fping sends ICMP echo requests in parallel, which is significantly faster than sequential ping for large ranges.

┌──(kali㉿kali)-[~]
└─$ fping -a -g $TARGET_IP/24 2>/dev/null
Explain command
-a Show only alive (responding) hosts in output.
-g Generate a target list from a CIDR network range.
$TARGET_IP/24 Target network in CIDR notation derived from the variable.
2>/dev/null Redirect stderr to /dev/null to suppress error messages.

-a shows only alive hosts, -g generates the address range from CIDR notation.

For a specific range:

┌──(kali㉿kali)-[~]
└─$ fping -a -g 10.10.10.1 10.10.10.254 2>/dev/null
Explain command
-a Show only alive (responding) hosts in output.
-g Generate a target list from a start and end IP range.
10.10.10.1 10.10.10.254 Start and end IP addresses defining the ping sweep range.
2>/dev/null Redirect stderr to /dev/null to suppress error messages.

With a count and timeout for noisy networks:

┌──(kali㉿kali)-[~]
└─$ fping -a -g -c 1 -t 500 $TARGET_IP/24 2>/dev/null
Explain command
-a Show only alive (responding) hosts in output.
-g Generate target list from a CIDR network range.
-c 1 Send only 1 ping packet per target host.
-t 500 Set per-target timeout to 500 milliseconds.
$TARGET_IP/24 CIDR subnet derived from target IP to sweep.
2>/dev/null Redirect stderr to null, suppressing error messages.

-c 1 sends one packet per host, -t 500 sets a 500ms timeout.

ping — Manual Single Host or Loop

Single host check:

┌──(kali㉿kali)-[~]
└─$ ping -c 3 $TARGET_IP
Explain command
-c 3 Send exactly 3 ICMP echo request packets then stop.
$TARGET_IP Variable placeholder representing the target host IP address.

Manual loop over a subnet when nmap and fping are not available:

┌──(kali㉿kali)-[~]
└─$ for i in $(seq 1 254); do (ping -c 1 -W 1 10.10.10.$i > /dev/null 2>&1 && echo "10.10.10.$i up") & done; wait

Replace 10.10.10 with the target subnet. The & backgrounds each ping so they run in parallel. wait holds until all complete.

ICMP Timestamp and Address Mask Requests

Some hosts block echo requests but respond to ICMP timestamp or address mask requests. Nmap covers these with additional flags:

┌──(kali㉿kali)-[~]
└─$ nmap -sn -PP $TARGET_IP/24
Explain command
-sn Ping scan only; disables port scanning, just discovers live hosts.
-PP Uses ICMP timestamp requests to discover live hosts.
$TARGET_IP/24 Target subnet derived from TARGET_IP variable with /24 CIDR mask.

-PP sends ICMP timestamp requests. -PM sends ICMP address mask requests. Combine with -PE for full coverage:

┌──(kali㉿kali)-[~]
└─$ nmap -sn -PE -PP -PM $TARGET_IP/24
Explain command
-sn Ping scan only; disables port scanning, used for host discovery.
-PE Sends ICMP echo request packets for host discovery.
-PP Sends ICMP timestamp request packets for host discovery.
-PM Sends ICMP address mask request packets for host discovery.
$TARGET_IP/24 Target subnet in CIDR notation scanning 256 addresses.

Interpreting Results

A responding host is live and reachable. Move directly to port scanning to identify what services are running. See Nmap Service Enumeration.

No response means one of three things: the host is down, ICMP is filtered by a firewall, or the host is up but not responding to ICMP. If you suspect ICMP is filtered, follow up with a TCP ping scan:

┌──(kali㉿kali)-[~]
└─$ nmap -sn -PS22,80,443,445 $TARGET_IP/24
Explain command
-sn Ping scan only; disables port scanning, host discovery only.
-PS22,80,443,445 TCP SYN ping to ports 22, 80, 443, 445 for host discovery.
$TARGET_IP/24 Target subnet derived from variable, scanning all 256 /24 hosts.

-PS sends TCP SYN packets to the specified ports. Hosts that respond with SYN-ACK or RST are alive regardless of ICMP policy.

Scanning from a Pivot Host

When the target subnet is only reachable through a compromised Linux host, run discovery directly from that host. See Network Awareness on Linux for identifying reachable subnets, and Proxychains and SOCKS Pivoting for routing nmap through a SOCKS proxy.

Note that proxychains does not support ICMP — use TCP-based host discovery (-PS, -PA) when scanning through a proxy.

References