Admin Network Technologies

Ping sweep for network security engineers


I swear my bash programming skills are getting worse and worse. What I really need is a bash scripting tips blog entry to remind myself of my favorite bash scripting tips. I have this for python and I refer toit and add to it all the time. I don’t care if anyone else never uses it, it’s worth having all my used tips in one place as I find I constantly forget the basics due to infrequent usage.

Oh. So to the point. What this blog post is nominally about is to provide a useable medium-quality ping swep that a network security engineer would find useful.

  • access to host on the subnet in question
  • this accessible host has a bash shell CLI, e.g., a Checkpoint firewall
  • ping and arp programs available
What it does

This script is designed to sweep through a /24 subnet, politely pausing one second per attempt. It send s a single PING to each IP. This is the things that makes it appealing to network security engineers. it does not require a reply, which is a common situation for network security appliances. It immediately checks the arp table afterwards to see if there is an arp entry (before that has a chance to age out). If so, it reports the IP as up.

The code

I call the program


  ping -c 1 -W 1 $1 > /dev/null
# arp -an output looks like: ? ( at 01:c0:ed:78:b3:dc [ether] on eth0
# or if not present, like ? ( at <incomplete> on eth0
  arp -an|grep -iv incomplete|grep -qi $1\)
  [ $? -eq 0 ] && echo Node with IP: $i is up.

if [[ ! -n $1 ]];
  echo "No subnet passed. Pass three octects like 10.29.129"
for i in ${subnet}.{1..254}
is_alive_ping $i
sleep 1

Apologies for the lousy programming. But it gets the job done.

./ 10.29.129
Node with IP: is up.
Node with IP: is up.
Node with IP: is up.
Node with IP: is up.
Node with IP: is up.
Node with IP: is up.
Node with IP: is up.

As a network security engineer you may be asked if it’s safe to use a paricular IP on one of your subnets where you have your equipment plus equipment frmo other groups. I provide a ping sweep script which reports which IPs are taken, not relying on an ICMP REPLY, but just on the ARP table entry which gets created if a device is on the network.

References and related

None so far!

Leave a Reply

Your email address will not be published. Required fields are marked *