How to specify nmap to add redirect address?

Question

I'm trying to ping the health of VM's using nmap utility.

# nmap -v -n -sP  192.168.102.116
 Host 192.168.102.116 appears to be down.
 Note: Host seems down. If it is really up, but blocking our ping probes, try -P0
 Nmap finished: 1 IP address (0 hosts up) scanned in 2.006 seconds

then I tried with direct ping, as it shows the host reachable. then I found the next hop directive in the ping output.

# ping 192.168.102.116
 PING 192.168.102.116 (192.168.102.116) 56(84) bytes of data.
 From 192.169.64.129: icmp_seq=1 Redirect Host(New nexthop: 192.169.64.149)
 64 bytes from 192.168.102.116: icmp_seq=1 ttl=52 time=15.6 ms

Env:- RHEL 5.11 nmap version - 4.11

$ netstat -r
  Kernel IP routing table
  Destination     Gateway         Genmask         Flags   MSS Window  irtt 
  Iface
  10.10.2.0      *               255.255.254.0   U         0 0          0 
  eth0
  169.254.0.0     *               255.255.0.0     U         0 0          0 
  eth0
  default         10.10.2.1      0.0.0.0         UG        0 0          0 
  eth0

Question

How to do it with the nmap utility? by specifying to ping host from the redirect address?

I found a similar option with fping utility --icmp-redirect-addr, likewise is there any option can specify next hop address so that nmap to scan the host properly

Note: this is production as I can only try with ping and nmap. For scanning many hosts in parallel ping took more time, so need to stick in nmap.

Answer 1

How come nmap is taking less time? I can't seem to reproduce that. In your case it is giving you a lower time since it can't reach the server so those times can't be compared.

ping -c1 ip-to-check will only send one probe and will take very little time.

In your case, and according to your outputs there seems to be some routing problem, check your routes since your ping is receiving a redirection. Use traceroute to see the hops your ping goes through and check your routes.

You can try to use nmap -sn --traceroute and see if that command accepts the redirection as ping does, but the best would be to check those routes since your IPs are on a different network and the route you have established to reach your destination is being redirected as the ping command shows.

Since it is easier to see my results here I edited my post instead answering your comment:

root@Caronte:~# time ping -c1 10.50.1.105
PING 10.50.1.105 (10.50.1.105) 56(84) bytes of data.
64 bytes from 10.50.1.105: icmp_seq=1 ttl=64 time=0.127 ms

--- 10.50.1.105 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.127/0.127/0.127/0.000 ms

real    0m0,002s
user    0m0,000s
sys     0m0,000s
root@Caronte:~# time nmap -sn -Pn 10.50.1.105

Starting Nmap 7.40 ( https://nmap.org ) at 2018-07-25 15:25 CEST
Nmap scan report for 10.50.1.105
Host is up.
Nmap done: 1 IP address (1 host up) scanned in 0.00 seconds

real    0m0,005s
user    0m0,000s
sys     0m0,004s

As you can see, on my machine nmap takes more time than ping.