# Network Mapping

- **URL:** https://hackindex.io/services/hosts/reconnaissance/network-mapping
- **Path:** Hosts > Reconnaissance
- **Up:** [Reconnaissance](https://hackindex.io/services/hosts/reconnaissance.md)
- **Published:** 2025-12-29
- **Updated:** 2026-03-30

Network mapping is the step where you **turn a scope into a concrete target list**.  
The goal is simple: **identify live hosts** (and sometimes their MAC/vendor) **without touching ports**.

Use this when you want:

- a clean list of reachable IPs before doing port/service enumeration
- low-noise discovery (compared to full port scans)
- to understand what’s actually online inside a subnet

## Choosing the right discovery method

### ICMP (Ping) discovery

ICMP is often the first choice, but it’s also the first thing that gets blocked.  
If ICMP is filtered, hosts may still be alive but appear “down”.

### ARP discovery (local subnet only)

ARP discovery is extremely reliable **on the same Layer 2 network** (same VLAN/subnet).  
Even if ICMP is blocked, ARP will often still work locally.

| Method | Best for | Weakness |
| --- | --- | --- |
| ICMP | Routed networks, quick reachability checks | Can be blocked by firewalls / host settings |
| ARP | Local/internal pentests where you’re on the LAN | Does not work across routers |

### 

## Nmap host discovery

### Basic host sweep

Use this to find live hosts across a range without scanning ports.

```bash
nmap -sn -T3 $TARGET_IP/24
```

- `-sn` = host discovery only (no port scan)
- `-T<0-5>` = speed vs noise (T3 is usually fine)
- `-vv` = more readable output while mapping

### Sweep a /24 CIDR

Quick sweep when you already know the base network.

```bash
nmap -sn -T3 $TARGET_SUBNET.1-254
```

### Fast sweep without DNS resolution

DNS lookups slow scans down and can produce noisy outbound queries.

```bash
nmap -sn -n -T<0-5> $TARGET_CIDR
```

Use this when:

- DNS is slow/unreliable
- you want cleaner traffic
- you’re scanning large ranges

## ARP-based discovery (local subnet)

### netdiscover (ARP + vendor/MAC hints)

Netdiscover is great for quickly understanding what devices are on a local subnet.

```bash
netdiscover -r $TARGET_CIDR -P -N -f
```

Typical value:

- Identifying printers, phones, APs, virtual hosts by vendor fingerprinting
- Quickly confirming what is “real” vs “dead” in a /24

### arp-scan (fast + clean output)

If you want raw speed and straight results:

```bash
arp-scan $TARGET_CIDR
```

Best when:

- you are physically/virtually on the same network segment
- you want a quick MAC/IP list to feed into later steps

## ICMP sweeps with bash

### Sequential ICMP sweep (/24)

Low noise, slower, but very predictable.

```bash
for i in $(seq 1 254); do
    ip="$TARGET_SUBNET.$i"
    ping -c 1 -W 1 "$ip" 2>/dev/null | grep "icmp_seq=1" | cut -f4 -d ' ' | tr '\n:' '\n' || true
done
```

Use this when:

- you’re on a restricted shell
- you don’t want high parallel traffic
- tools like nmap aren’t available

### Parallel ICMP sweep (/24)

Fast but louder (lots of concurrent pings).

```bash
for i in {1..254}; do
    ( ip="$TARGET_SUBNET.$i"; ping -c1 -W1 "$ip" >/dev/null 2>&1 && echo "$ip" ) &
done; wait
```

Use this when:

- you need quick answers
- you’re okay generating a burst of ICMP traffic

## High-speed host discovery (fping)

### Fast ICMP sweep with only alive output

This is one of the fastest ways to get a clean alive-host list.

```bash
fping -a -g $TARGET_CIDR
```

- `-g` generates the target list
- `-a` prints only alive hosts

Perfect for:

- generating `targets.txt`
- feeding into later enumeration

## ICMP discovery with nping

### ICMP echo to observe filtering behavior

Useful when you want more control/visibility than plain `ping`.

```bash
nping --icmp $TARGET_CIDR
```

Use this when:

- you’re testing how ICMP is handled
- you suspect rate limiting / filtering / weird network behavior

## Common pitfalls

- **No ICMP replies ≠ host is down** (ICMP can be blocked)
- **ARP discovery only works locally** (same subnet/VLAN)
- **NMAP Timing matters**: faster (`-T4/-T5`) = more noise + more detection risk
- If results look “too empty”, switch method:

- ICMP fails → try ARP (if local)
- ARP not possible → rely on routed checks / environment knowledge