Skip to content
HackIndex logo

HackIndex

Network Mapping

4 min read Mar 30, 2026

Network mapping is the step where you turn a scope into a concrete target list.
The goal is simple: identify live hosts (and sometimes their MAC/vendor) without touching ports.

Use this when you want:

  • a clean list of reachable IPs before doing port/service enumeration

  • low-noise discovery (compared to full port scans)

  • to understand what’s actually online inside a subnet

Choosing the right discovery method

ICMP (Ping) discovery

ICMP is often the first choice, but it’s also the first thing that gets blocked.
If ICMP is filtered, hosts may still be alive but appear “down”.

ARP discovery (local subnet only)

ARP discovery is extremely reliable on the same Layer 2 network (same VLAN/subnet).
Even if ICMP is blocked, ARP will often still work locally.

Method

Best for

Weakness

ICMP

Routed networks, quick reachability checks

Can be blocked by firewalls / host settings

ARP

Local/internal pentests where you’re on the LAN

Does not work across routers

Nmap host discovery

Basic host sweep

Use this to find live hosts across a range without scanning ports.

┌──(kali㉿kali)-[~]
└─$ nmap -sn -T3 $TARGET_IP/24
Explain command
-sn Ping scan only; disables port scanning, host discovery only.
-T3 Sets timing template to 'Normal' for balanced speed and accuracy.
$TARGET_IP/24 Target subnet derived from variable, scanning all 256 addresses in /24.

  • -sn = host discovery only (no port scan)

  • -T<0-5> = speed vs noise (T3 is usually fine)

  • -vv = more readable output while mapping

Sweep a /24 CIDR

Quick sweep when you already know the base network.

┌──(kali㉿kali)-[~]
└─$ nmap -sn -T3 $TARGET_SUBNET.1-254
Explain command
-sn Ping scan only; disables port scanning, host discovery only.
-T3 Sets timing template to 3 (Normal); balances speed and accuracy.
$TARGET_SUBNET.1-254 Scans host range .1 to .254 within the specified subnet variable.

Fast sweep without DNS resolution

DNS lookups slow scans down and can produce noisy outbound queries.

┌──(kali㉿kali)-[~]
└─$ nmap -sn -n -T<0-5> $TARGET_CIDR
Explain command
-sn Ping scan only; disables port scanning, host discovery only.
-n Disables DNS resolution to speed up the scan.
-T<0-5> Sets timing template; 0=paranoid, 5=insane speed aggressiveness.
$TARGET_CIDR Target network range in CIDR notation (e.g. 192.168.1.0/24).

Use this when:

  • DNS is slow/unreliable

  • you want cleaner traffic

  • you’re scanning large ranges

ARP-based discovery (local subnet)

netdiscover (ARP + vendor/MAC hints)

Netdiscover is great for quickly understanding what devices are on a local subnet.

┌──(kali㉿kali)-[~]
└─$ netdiscover -r $TARGET_CIDR -P -N -f
Explain command
-r $TARGET_CIDR Scan a specific IP range in CIDR notation instead of auto-detecting.
-P Print results to stdout and exit (non-interactive/passive output mode).
-N Do not print the header/banner in the output.
-f Enable fast mode, reducing the number of ARP packets sent.

Typical value:

  • Identifying printers, phones, APs, virtual hosts by vendor fingerprinting

  • Quickly confirming what is “real” vs “dead” in a /24

arp-scan (fast + clean output)

If you want raw speed and straight results:

┌──(kali㉿kali)-[~]
└─$ arp-scan $TARGET_CIDR

Best when:

  • you are physically/virtually on the same network segment

  • you want a quick MAC/IP list to feed into later steps

ICMP sweeps with bash

Sequential ICMP sweep (/24)

Low noise, slower, but very predictable.

for i in $(seq 1 254); do
    ip="$TARGET_SUBNET.$i"
    ping -c 1 -W 1 "$ip" 2>/dev/null | grep "icmp_seq=1" | cut -f4 -d ' ' | tr '\n:' '\n' || true
done

Use this when:

  • you’re on a restricted shell

  • you don’t want high parallel traffic

  • tools like nmap aren’t available

Parallel ICMP sweep (/24)

Fast but louder (lots of concurrent pings).

for i in {1..254}; do
    ( ip="$TARGET_SUBNET.$i"; ping -c1 -W1 "$ip" >/dev/null 2>&1 && echo "$ip" ) &
done; wait

Use this when:

  • you need quick answers

  • you’re okay generating a burst of ICMP traffic

High-speed host discovery (fping)

Fast ICMP sweep with only alive output

This is one of the fastest ways to get a clean alive-host list.

┌──(kali㉿kali)-[~]
└─$ fping -a -g $TARGET_CIDR
Explain command
-a Show only alive (responding) hosts in output.
-g Generate a target list from a CIDR network range.
$TARGET_CIDR Target network address in CIDR notation (e.g. 192.168.1.0/24).

  • -g generates the target list

  • -a prints only alive hosts

Perfect for:

  • generating targets.txt

  • feeding into later enumeration

ICMP discovery with nping

ICMP echo to observe filtering behavior

Useful when you want more control/visibility than plain ping.

┌──(kali㉿kali)-[~]
└─$ nping --icmp $TARGET_CIDR
Explain command
--icmp Use ICMP as the probe protocol for sending packets.
$TARGET_CIDR Target network range in CIDR notation (e.g. 192.168.1.0/24).

Use this when:

  • you’re testing how ICMP is handled

  • you suspect rate limiting / filtering / weird network behavior

Common pitfalls

  • No ICMP replies ≠ host is down (ICMP can be blocked)

  • ARP discovery only works locally (same subnet/VLAN)

  • NMAP Timing matters: faster (-T4/-T5) = more noise + more detection risk

  • If results look “too empty”, switch method:

    • ICMP fails → try ARP (if local)

    • ARP not possible → rely on routed checks / environment knowledge