/commands/nmap/nmap-ping-scan-network
nmap -sn 192.168.1.0/24: find live hosts on a network (ping scan)
- tool
- Nmap
- versions
- Nmap 7.x
- os
- linux, macos, windows
nmap -sn 192.168.1.0/24 performs host discovery only: it finds which addresses in the network answer, without scanning any ports. Run it with sudo on a local network so Nmap uses ARP requests, which every host must answer and which also report the MAC address and vendor. -sn was called -sP in old Nmap versions.
When to use it
A ping scan answers "which addresses are in use?" quickly and with little traffic: taking an inventory of a home or office LAN, finding the IP a new device received from DHCP, or checking which servers in a range respond before a heavier port scan with nmap -p. It does not tell you which services run; for that, add ports and -sV.
Related options
| Option | What it does |
|---|---|
| -sn | Host discovery only, no port scan (formerly -sP). |
| -sL | List scan: prints the targets and their reverse DNS names without sending any probe to them. |
| -Pn | Skip discovery and treat every target as up; the opposite of -sn. |
| -PR | ARP ping; the default for root on a local Ethernet network. |
| -PS / -PA ports | TCP SYN or ACK probes to the given ports; replace the default probes. |
| -PE / -PP | ICMP echo or timestamp requests only. |
| --send-ip | Send IP-level probes even on the local network instead of ARP. |
| -n / -R | Never or always do reverse DNS resolution. |
Examples
sudo nmap -sn 192.168.1.0/24 # whole /24, ARP on the local LAN
sudo nmap -sn 192.168.1.1-50 # a range
sudo nmap -sn 10.0.0.0/24 --exclude 10.0.0.1 # skip an address
nmap -sn -iL hosts.txt # targets from a file
sudo nmap -sn -oG - 192.168.1.0/24 | awk '/Up$/{print $2}' # just the live IPs
sudo nmap -sn -PS22,443 203.0.113.0/28 # remote network: TCP SYN discovery probes
nmap -sL 192.168.1.0/28 # list targets (and reverse DNS) without sending probesA live host appears as Nmap scan report for 192.168.1.20 followed by Host is up (0.0021s latency). and, on a LAN with root, a MAC Address: line. The summary at the end gives the count, for example 256 IP addresses (12 hosts up).
Privileges change the probes
| Run as | Probes used by -sn |
|---|---|
| root, local Ethernet | ARP (IPv4) or neighbor discovery (IPv6): reliable |
| root, remote network | ICMP echo, TCP SYN to 443, TCP ACK to 80, ICMP timestamp |
| unprivileged user | TCP connect() to ports 80 and 443 only: hosts with neither open may look down |
Firewalled hosts on a remote network may not answer any discovery probe; they are not listed even though they are up. Use -Pn with a port scan for those, or add probes they allow (-PS22).
Speed and output
sudo nmap -sn -T4 --min-parallelism 100 10.0.0.0/16 # faster on large ranges
sudo nmap -sn -oX hosts.xml 192.168.1.0/24 # XML output for tools
sudo nmap -sn -n 192.168.1.0/24 # skip reverse DNS lookupsTroubleshooting
0 hosts upon a remote range while you know hosts exist: a firewall drops the default probes. Add probes the network allows (-PS22,443) or use-Pnwith a port scan; see Host seems down.WARNING: No targets were specified, so 0 hosts scanned.: the target is missing or was swallowed by an option that takes an argument; see that error.- A host name that cannot be resolved is reported as
Failed to resolveand skipped; see that page.
FAQ
What is the difference between nmap -sn and nmap -Pn?
They are opposites. -sn runs only host discovery and skips the port scan; -Pn skips host discovery and port-scans every target as if it were up. Use -Pn when discovery misses hosts that you know are online.
Why does a phone or laptop on my Wi-Fi not show up?
Without root, nmap sends only TCP connect probes to ports 80 and 443, which most clients do not answer. Run the scan with sudo so nmap uses ARP; a device in power-saving mode may still miss a single scan, so repeat it.
Is -sP still accepted?
-sP is the name from older Nmap releases. Current documentation lists only -sn, so use -sn in new scripts.