# ICMP Host Discovery and Ping Sweeps

- **URL:** https://hackindex.io/services/hosts/enumeration/icmp-host-discovery-and-ping-sweeps
- **Path:** Hosts > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/hosts/enumeration.md)
- **Published:** 2026-03-16
- **Updated:** 2026-03-30

ICMP echo requests are the fastest way to identify live hosts on a network. A ping sweep sends an ICMP echo request to each address in a range and records which ones respond. The results tell you what is alive before spending time on port scanning.

ICMP is blocked on some hardened networks and cloud environments: no response does not always mean the host is down. Combine with TCP-based discovery when ICMP gives incomplete results.

Discovery tools for ping sweeps:

- Nmap `-sn` for ICMP + TCP probe sweep
- fping for fast parallel ICMP sweep across large ranges
- Manual `ping` loop for single-host or small-range checks

## ICMP host discovery with Nmap ping sweep

Nmap's `-sn` flag performs host discovery without port scanning. By default it sends ICMP echo requests, TCP SYN to port 443, TCP ACK to port 80, and an ICMP timestamp request.

```bash
nmap -sn $TARGET_IP/24
# Starting Nmap 7.94
# Nmap scan report for 10.10.10.1
# Host is up (0.0023s latency).
# Nmap scan report for 10.10.10.5
# Host is up (0.0041s latency).
# Nmap scan report for 10.10.10.20
# Host is up (0.0089s latency).
# Nmap done: 256 IP addresses (3 hosts up) scanned in 2.41 seconds
```

For ICMP only, without the TCP fallback:

```bash
nmap -sn -PE $TARGET_IP/24
```

`-PE` restricts discovery to ICMP echo requests. Faster but misses hosts that block ICMP.

Output live hosts only: useful for piping into further scans:

```bash
nmap -sn $TARGET_IP/24 | grep "Nmap scan report" | awk '{print $NF}'
```

## fping: Fast Parallel Ping

fping sends ICMP echo requests in parallel, which is significantly faster than sequential ping for large ranges.

```bash
fping -a -g $TARGET_IP/24 2>/dev/null
```

`-a` shows only alive hosts, `-g` generates the address range from CIDR notation.

For a specific range:

```bash
fping -a -g 10.10.10.1 10.10.10.254 2>/dev/null
```

With a count and timeout for noisy networks:

```bash
fping -a -g -c 1 -t 500 $TARGET_IP/24 2>/dev/null
```

`-c 1` sends one packet per host, `-t 500` sets a 500ms timeout.

## ping: Manual Single Host or Loop

Single host check:

```bash
ping -c 3 $TARGET_IP
```

Manual loop over a subnet when nmap and fping are not available:

```bash
for i in $(seq 1 254); do (ping -c 1 -W 1 10.10.10.$i > /dev/null 2>&1 && echo "10.10.10.$i up") & done; wait
```

Replace `10.10.10` with the target subnet. The `&` backgrounds each ping so they run in parallel. `wait` holds until all complete.

## ICMP Timestamp and Address Mask Requests

Some hosts block echo requests but respond to ICMP timestamp or address mask requests. Nmap covers these with additional flags:

```bash
nmap -sn -PP $TARGET_IP/24
```

`-PP` sends ICMP timestamp requests. `-PM` sends ICMP address mask requests. Combine with `-PE` for full coverage:

```bash
nmap -sn -PE -PP -PM $TARGET_IP/24
```

## Interpreting Results

A responding host is live and reachable. Move directly to port scanning to identify what services are running. See [Nmap Service Enumeration](https://hackindex.io/services/hosts/enumeration/nmap-service-enumeration).

No response means one of three things: the host is down, ICMP is filtered by a firewall, or the host is up but not responding to ICMP. If you suspect ICMP is filtered, follow up with a TCP ping scan:

```bash
nmap -sn -PS22,80,443,445 $TARGET_IP/24
```

`-PS` sends TCP SYN packets to the specified ports. Hosts that respond with SYN-ACK or RST are alive regardless of ICMP policy.

## Scanning from a Pivot Host

When the target subnet is only reachable through a compromised Linux host, run discovery directly from that host. See [Network Awareness on Linux](https://hackindex.io/platforms/linux/enumeration/network-awareness) for identifying reachable subnets, and [Proxychains and SOCKS Pivoting](https://hackindex.io/platforms/linux/lateral-movement/ssh-port-forwarding-and-tunneling) for routing nmap through a SOCKS proxy.

Note that proxychains does not support ICMP: use TCP-based host discovery (`-PS`, `-PA`) when scanning through a proxy.

## References

- [Nmap Book](https://nmap.org/book/host-discovery.html) - Host Discovery Official Nmap documentation covering all host discovery techniques including ICMP, TCP, and ARP methods.
- [fping(1)](https://fping.org/fping.1.html) - fping manual page Full reference for fping options including parallel scanning, timeout, and output formatting.