CLI: Pinging∕scanning a range of IPs

You can use nmap to quickly ping/scan a whole range of IPs.

If you don't have nmap already installed, you can install it with:

# deb-based (Debian, Ubuntu, Mint, Raspbian, Kali, etc.)
apt install nmap

# rpm-based (Fedora, CentOS, etc.)
dnf install nmap

# Arch
pacman -S nmap

# Alpine
apk add nmap

Scanning IPs

This command will scan all addresses in the range from 127.0.0.1 to 127.0.0.5.

nmap -sn 127.0.0.1-5

Example result:

Starting Nmap 7.80 ( https://nmap.org ) at 2023-04-01 13:25 CEST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00013s latency).
Nmap scan report for 127.0.0.2
Host is up (0.00030s latency).
Nmap scan report for 127.0.0.3
Host is up (0.00022s latency).
Nmap scan report for 127.0.0.4
Host is up (0.00019s latency).
Nmap scan report for 127.0.0.5
Host is up (0.00016s latency).
Nmap done: 5 IP addresses (5 hosts up) scanned in 0.00 seconds

To scan the whole subnet, you can also use this notation:

nmap -sn 127.0.0.0/24

Explanation

-sn option tells nmap to do only the discovery part, skipping the port scanning.

Relevant part of the man page:

       -sn (No port scan)
           This option tells Nmap not to do a port scan after host discovery,
           and only print out the available hosts that responded to the host
           discovery probes. This is often known as a “ping scan”, but you can
           also request that traceroute and NSE host scripts be run. This is
           by default one step more intrusive than the list scan, and can
           often be used for the same purposes. It allows light reconnaissance
           of a target network without attracting much attention. Knowing how
           many hosts are up is more valuable to attackers than the list
           provided by list scan of every single IP and host name.

           Systems administrators often find this option valuable as well. It
           can easily be used to count available machines on a network or
           monitor server availability. This is often called a ping sweep, and
           is more reliable than pinging the broadcast address because many
           hosts do not reply to broadcast queries.

           The default host discovery done with -sn consists of an ICMP echo
           request, TCP SYN to port 443, TCP ACK to port 80, and an ICMP
           timestamp request by default. When executed by an unprivileged
           user, only SYN packets are sent (using a connect call) to ports 80
           and 443 on the target. When a privileged user tries to scan targets
           on a local ethernet network, ARP requests are used unless --send-ip
           was specified. The -sn option can be combined with any of the
           discovery probe types (the -P* options, excluding -Pn) for greater
           flexibility. If any of those probe type and port number options are
           used, the default probes are overridden. When strict firewalls are
           in place between the source host running Nmap and the target
           network, using those advanced techniques is recommended. Otherwise
           hosts could be missed when the firewall drops probes or their
           responses.

           In previous releases of Nmap, -sn was known as -sP.

Note: although this exact use of nmap is relatively harmless, always be careful when you're using nmap (and similar tools) on public IP addresses.

Ask me anything / Suggestions