I know how to use nmap to find the list of hosts that are currently online. What I would like to do is get a list of just their IP addresses, now it displays extra information such as

Nmap scan report for 192.168.x.x' and 'Host is up (0.12s latency).

What I would like is to be able to run an nmap command, get a text document of the IP addresses that are currently online.

Is this at all possible?

migrated from serverfault.com Jan 28 '15 at 22:04

This question came from our site for system and network administrators.


This is a common one:

nmap -n -sn -oG - | awk '/Up$/{print $2}'

Quick rundown of options and commands:

  • -n turns off reverse name resolution, since you just want IP addresses. On a local LAN this is probably the slowest step, too, so you get a good speed boost.
  • -sn means "Don't do a port scan." It's the same as the older, deprecated -sP with the mnemonic "ping scan."
  • -oG - sends "grepable" output to stdout, which gets piped to awk.
  • /Up$/ selects only lines which end with "Up", representing hosts that are online.
  • {print $2} prints the second whitespace-separated field, which is the IP address.

You could pipe it to awk:

nmap -sP | awk '/is up/ {print up}; {gsub (/\(|\)/,""); up = $NF}'

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.