First I try running nmap -sn ip/24 to check live hosts on a subnet. It returns that all 255 hosts are live which I know is not true. I do fping -g ip/24 and get that 7 hosts are up which makes more sense.

Now I'm trying to figure out network topology using nmap -sn --traceroute ip/24 and the entire range of 0-255 is included. How can I just use the hosts that were returned by the fping command? I figure there has to be some way to pipe that argument or something to the nmap traceroute command, but I have no idea how to do this.

  • 1
    Hmm, can you use tcpdump or wireshark to see how the nmap and fping packets outgoing differ? – thrig Oct 14 '16 at 16:52
  • so it looks like all the ones that nmap -sn shows are up but I don't think actually are, respond with ICMP echo request. I have very limited network knowledge so not sure how this works. – Austin Oct 14 '16 at 17:03
  • 1
    The nmap -sn is ping scan, but not necessary ICMP, if used in local network it will use ARP, in that case it may possible that a gateway could give fake arp responses. You can try nmap -sn -PE (real ICMP) – a0f3dd13 Oct 14 '16 at 17:20
  • 1
    Yes, if a host don't reply to ICMP. But for that you can add yet another host discovery technique, like -PS for tcp syn, -PA for tcp ack, -PU for UDP, or yet others. – a0f3dd13 Oct 14 '16 at 17:30
  • 1
    You can add multiple host discovery techniques: nmap -sn -PE -PA -PE -PU --traceroute ip/24 – a0f3dd13 Oct 14 '16 at 17:31

you could use fping output as nmap target list:

fping -aqg ip/24 | xargs nmap -sn --traceroute

If your problem is that some gateway in your network is giving fake ARP responses (generating false positives), you can use -sn -PE to fix that:

nmap -sn -PE --traceroute ip/24

That way, nmap will exclusively show a host (and make a traceroute) if the host reply the ICMP request (ping).

| improve this answer | |
  • I'm trying to look at the topology graphically, is it possible to make this command work for zenmap? – Austin Oct 14 '16 at 17:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.