The Best Ping Sweep Tools and Software

A ping sweep is a network scanning technique used to determine which devices on a network are active and reachable. It works by sending Internet Control Message Protocol (ICMP) echo requests, commonly known as “pings,” to a range of IP addresses. Devices that respond with an echo reply are identified as active, while non-responding addresses are considered inactive or unreachable.

What Ping Sweep is Good For

Ping sweeps are especially useful in network management for several purposes:

• Network Inventory and Discovery: Administrators can use ping sweeps to identify active devices and build an inventory of IP-connected hardware such as servers, workstations, IoT devices, and network appliances.
• Troubleshooting: If parts of a network are experiencing connectivity issues, a ping sweep can help pinpoint inactive or unreachable devices.
• Monitoring Network Health: Regular sweeps allow administrators to track the availability of devices and detect anomalies, such as unexpected downtime.
• Subnet Utilization Analysis: Ping sweeps can help assess IP address utilization within subnets, identifying unused or misconfigured addresses.

Network Monitoring Tools Based on Ping Sweep

Many network monitoring tools integrate ping sweep functionalities to enhance their capabilities. These tools often automate the process, providing ongoing visibility into network activity. By combining ping sweeps with features like alerting, performance monitoring, and analytics, these solutions offer more than just device discovery—they enable proactive network management.

Tools based on ping sweeps are especially advantageous for detecting changes in the network, such as newly added or removed devices. This ensures that network administrators remain informed about their environment and can address issues before they escalate into major problems. By leveraging such tools, organizations can maintain high levels of operational efficiency and network reliability.

Here’s our list of the best ping sweep tools available today:

1. Paessler PRTG EDITOR’S CHOICE This tool performs a Ping sweep recursively as part of its network discovery routines
2. Zenmap A free graphical interface for the Nmap network discovery and mapping system that runs on Linux, Mac OS, Unix, and Windows.
3. fping A command-line Ping tool for Linux that can operate on ranges of IP addresses.
4. Network Pinger A free Ping tool for Windows that includes Ping sweep capabilities.
5. hping A free command-line Ping tool for Linux, Unix, and Mac OS, and Windows.
6. Angry IP Scanner A free network analysis tool for Windows, Linux, and Unix.
7. Advanced IP Scanner – A free network address scanner for Windows that has more than 30 million users.
8. SolarWinds Switch Port Mapper with Engineer’s Toolset A network discovery tool lets you scan a range of IP addresses to identify free addresses and those that are in use.
9. NetScan Tools Basic Edition A free ad-supported bundle of tools for Windows that includes a Ping sweep.
10. Pinkie A free network analysis kit for Windows that includes a Ping sweep.
11. Mitec Network Scanner A free network analysis toolkit for Windows and Windows Server that includes a Ping sweep feature.

The Best Ping Sweep Tools

1. Paessler PRTG (FREE TRIAL)

Paessler PRTG is a comprehensive system monitoring tool that uses a range of techniques to map networks and the devices connected to them. PRTG is also able to monitor the network performance of applications and web services. The visibility of the tool extends to online services and remote sites.

Key Features:

• Versatile Monitoring: Utilizes a variety of sensors for comprehensive monitoring of networks, applications, and servers.
• Customizable Sensors: Offers the flexibility to tailor sensors to specific needs, enhancing monitoring relevance and efficiency.
• Auto-Discovery: Supports automatic network discovery for efficient mapping and monitoring of network devices.

Why do we recommend it?

Paessler PRTG is a bundle of system monitoring services. The package includes several versions of Ping for ad-hoc connection testing. The whole PRTG system is centered on a network discovery routine, which is based on Ping and SNMP. This service repeats constantly so you get live device availability reports from the PRTG package.

Among the many protocols and systems that PRTG uses, Ping is one of the most central. The PRTG installation ends with a discovery phase. That tracks down every device connected to the network and logs them in a register. The inventory also allows the PRTG software to compile a network map that shows the connections between devices. That system probe is performed with a Ping sweep.

Standard Ping contacts one IP address. It is a system command that is available to any operating system that incorporates network services. If your computer is connected to a network, you can go to the command line and issue a Ping query. The Ping sweep technique is an adaptation of that tool. To get in touch with every node on the network, Paessler put a Ping command in a looped routine. The Ping sensor works sequentially through every feasible network address and issues a Ping to that destination. If the sensor gets a response, that address is in use and further enquiries can derive detailed information about the device that it represents.

The Ping sweep is a starting point of discovery. Other tools add in the details of each device’s characteristics. The SNMP system gives a lot of detail on all network devices and their current statuses. So, The Paessler Ping sweep works in concert with other protocols and utilities to map your network. The detection cycle continues while the monitoring software is active. This operation keeps the device register up to date and reorganizes the network map should any devices be removed, added, moved, or changed.

Who is it recommended for?

Paessler PRTG is available as a SaaS system or you can opt to download the software package and run it on Windows Server. You can use the package for free if you only activate 100 sensors, which is a great offer for small businesses. Paid plans are suitable for mid-sized and large businesses.

Paessler PRTG can be installed on Windows Server or you can opt to get it as a cloud-based service. The system is implemented as a group of sensors. One of those is the Ping sensor. You can get Paessler PRTG for free if you implement up to 100 sensors. You have to pay if you need more sensors. Paessler offers a 30-day free trial with unlimited sensors, so you can try out the system before paying for it.

Paessler PRTG Download 30-day FREE Trial

2. Zenmap

Nmap is a free set of network system tools that execute from the command line. Zenmap is a GUI version of Nmap, and so it is easier to use. The software can be installed on Linux, Mac OS, Unix, and Windows.

Key Features:

• Free and Open Source: Offers a cost-effective solution for network scanning with a strong community support.
• Versatile Scanning Profiles: Includes predefined and customizable scanning profiles for targeted network analysis.
• Graphical Network Mapping: Provides visual network mapping for easier interpretation and analysis of network structure.

Why do we recommend it?

Zenmap is a useful free tool that adds a graphical user interface to the ever-popular Nmap. While many network administrators and security consultants use the Nmap tool at the command line, this just puts a mini command window in an app. The interface also provides a Ping implementation.

The scan format is dictated by a Profile that details search parameters. The Zenmap GUI includes a number of set profiles, but you can create your own scan specification by editing an existing profile and saving it as a new version. Zenmap can perform scans with TCP as well as with Ping. The output of a scan will have a different layout depending on the profile. You can get the IP addresses of active hosts, plus the hostname of each device. The scan can be changed to use TCP and show the open ports on each computer or router.

The raw output of the underlying Nmap process is shown in the first tab of the interface. These details are difficult to read, but all subsequent tabs in the viewer interpret the data into easy-to-read records. One of the display formats is a Topology Mapper, which gives a graphical representation of all the links in your network.

Zenmap results can be stored as XML files.

Who is it recommended for?

Zenmap is a useful tool for any network administrator to have to hand. It provides a visual network map, which is easier to comprehend than the list of addresses that you get with Nmap. However, there are other free tools that draw better topology maps, such as Icinga 2 and Zabbix.

3. fping

fping is a command-line tool for Linux systems. This free software requires an IP address range as a parameter in order to start the sweep. It is possible to enter this rage in CIDR notation with an address and mask length combination, such as 192.168.1.0/24. Alternatively, you can list IP Addresses in a file and pipe it into the command. You can get a report on IP address allocation in text format from your DHCP server and feed that into fping. As with any Linux command-line tool, you can pipe the output to a text file.

Key Features:

• Linux CLI Utility: Optimized for Linux users, offering efficient network scanning from the command line.
• Multiple Address Pinging: Capable of pinging a range of addresses simultaneously, improving scanning efficiency.
• Subnet and IP Version Filtering: Supports filtering by subnet or IP version, allowing for targeted network analysis.

Why do we recommend it?

There are a number of variants of Ping and fping is one of them – hping (detailed below) is another. The improvement that fping offers over the original Ping is that it will ping several addresses rather than just one. Each address in a given range or list will be contacted several times.

Switches in the utility allow you to limit the sweep to just IPv4 or IPv6 addresses. You can specify that only active hosts appear in the list, or you can ask to see all IP addresses in the range with inactive addresses labeled as unreachable. Another feature of the tool is the ability to link the output to DNS records. This displays the hostname for encountered IP addresses. If the DNS entry looks wrong or if a record is missing a hostname, you can spot DNS problems.

This is an on-demand tool, but you could schedule runs by putting the command in a batch file and running it as a cron job.

Who is it recommended for?

The fping utility is only available for Linux and it is a command line tool. The big advantage of this system over Ping is that you don’t have to construct your own for loop to get Ping to cycle through several addresses. The output is the same as Ping for each address.

4. Network Pinger

The name of this tool tells you that ping lies at the core of its methodology. Network Pinger is a free tool that runs on Windows. The scanner requires an address range as input, and this can be expressed as a subnet in CIDR notation. The program pings each address in the sequence and reports on the responses.

Key Features:

• Visual Tracking: Features graphical representations of ping results, enhancing data readability and analysis.
• Comprehensive Toolset: Includes additional utilities like IP calculator and switch port mapper, extending its functionality beyond simple pinging.
• Adaptable Scanning: Capable of scanning large networks and filtering results by subnet for precise network monitoring.

Why do we recommend it?

Network Pinger is a nice free tool for Windows that you can use in many ways. You can Ping the whole network, a segment, an IP address range, or even a non-sequential list of addresses. The output can be seen as text, as pie charts, or graphs.

The interface shows the output of the serial ping as it progresses through the IP address range. Graphical displays in the dashboard show the response rate encountered with each ping execution. A pie chart shows the percentages of addresses that could be reached and those that could not. The graphics in this ping sweep software are a really nice touch and they make it very easy to quickly sense the state of the network.

Other functions of Network Pinger let you issue a ping to a single address. A Traceroute function and a switch port mapper come built-in. Planning features include an IP calculator and statistical analysis reports. The Network Pinger contains many useful diagnostic tools that help you investigate the health of your network and find solutions to communication problems.

Who is it recommended for?

This is a busy utility with lots of extra features besides Ping. You can use it for an ad-hoc scan or set it to run on a schedule or constantly. Among its features are a port scan utility and a TraceRoute implementation. It is handy for any administrator with a Windows PC.

5. hping

hping is a command-line utility, so it doesn’t have the sophistication of GUI-based interfaces that have become common in modern network management tools. The format of this free tool will appeal to longer-serving network administrators used to using commands such as Ping and Traceroute. The latest version of this software is hping3. The tool is free to use. hping3 installs on Linux, Unix, and Mac OS and Windows.

Key Features:

• Flexible Protocol Testing: Supports ICMP, TCP, and UDP protocols for comprehensive network testing and analysis.
• Command-Line Operation: Provides a lightweight, command-line interface for advanced users and system administrators.
• Cross-Platform Compatibility: Runs on Linux, Unix, Mac OS, and Windows, offering versatile deployment options.

Why do we recommend it?

The hping utility is a command line system that lets you send out repetitive pings to a range of addresses. It can also give you port scans for each contacted device. There are many options with this tool but you will never get a visual network map out of it.

Ping is a function specified in the Internet Control Message Protocol. It operates at the Internet Layer of the TCP/IP stack. It doesn’t have port visibility, an addressing system employed in the higher Transport Layer. hping sends out serial ping requests to each IP address in a given range. TCP and UDP messaging capabilities let you test the ports on your computers and routers. It also incorporates a Traceroute implementation.

As a command-line utility, you can pipe the output to a file for analysis. Many commands are included in this tool, such as the ability to translate hostnames to IP addresses and test firewalls.

hping is of interest to hackers because it can help gather information on a target computer and be used to launch a denial of service attack. So, hping has a bit of a bad boy reputation. However, this doesn’t mean that you shouldn’t use it to discover information about your own network and communication devices.

Who is it recommended for?

An advantage that hping has over fping is that it will run on Windows as well as Linux. The tool is free to use and is worth having to hand for ad-hoc investigations. This tool is very old and hasn’t been updated for a while. It provides a packet generator for network capacity testing.

6. Angry IP Scanner

Angry IP Scanner is a very popular ping sweep tool frequently recommended by professionals in comment sections and message boards. Possibly one of the reasons for its popularity could be the format of its interface. The dashboard gives straightforward lists of results, similar to the no-nonsense presentation of command-line utilities that highly experienced techies prefer, combined with the window-based fonts of GUI systems that make the output easier to read.

Key Features:

• Intuitive Operation: User-friendly interface simplifies network scanning for users of all technical levels.
• Multiple Export Formats: Supports exporting scan results in various file formats, enhancing data portability and analysis.
• DNS and Hostname Resolution: Provides detailed insights into network devices, including DNS and hostname information.

Why do we recommend it?

Angry IP Scanner is a utility for Windows that provides a pleasing display for a standard Ping sweep output. The tool allows you to scan a range of IP addresses or a non-sequential list. The display includes a color-coded status identifier that makes recognition really quick. Get address resolution and port scanning as well.

This free network analysis tool can be installed on Windows, Linux, and Unix. The scanner sweeps a given range of IP addresses that can be in CIDR notation format. It can check random IP addresses or a non-consecutive list given as an input file. Output can be directed to CSV, TXT, XML or IP-Port format files.

The standard ping sweep output shows each IP address in the requested scan range, whether they were contactable or not. Missing addresses are indicated by the absence of a ping round trip time for that record.

A DNS resolution function shows the hostname for a requested IP address if it can find it. The absence of a hostname for a record should raise alarms if that IP address was contactable because either your DNS records are out of date or you have an intruder on the network. The ping sweep results show whether each host has an open web host port, and if so, you will see the name of the web server system. You can get the MAC address of each host displayed for its IP address ping record.

The presence of hostname resolution and port activity details shows the ping sweep function doesn’t just employ ICMP ping commands. Alternative functions of this tool include computer and router port scanning.

Who is it recommended for?

This system is a good option for any network manager or system administrator. The tool only needs to be downloaded and there is no setup required, so you don’t need technical skills to use it. This tool will only run on Windows.

7. Advanced IP Scanner

Advanced IP Scanner can be installed on Windows 10 and it is free to use. You need to enter a scan IP address range before launching the sweep. You can also specify a list of IP addresses to check. The list has to originate in an XML file, which you first load it into a Favorites list. The results list expands each record to reveal the shared folders available on every detected host. The headline record for each IP address shows the hostname for that node, its MAC address, and the manufacturer of that device.

Key Features:

• Remote Device Access: Enables direct access to discovered devices, allowing for remote control and management.
• Detailed Device Information: Shows hostnames, MAC addresses, and device manufacturers for easy identification.
• Network Sharing Visibility: Identifies shared folders on network devices, facilitating resource management and access control.

Why do we recommend it?

Advanced IP Scanner looks a lot like Angry IP Scanner but it has a few extra features that can be really useful. As well as identifying live IP addresses on the network, this tool also shows shared folders, where available, on each discovered device. This system also includes a remote access tool.

Once the utility has identified each live node on the network, you can access that computer and execute commands on it. You can also turn on computers on the network, put them into standby mode, or turn them off.  A range of addresses to scan is required before launching the sweep. The output from a scan can be written to CSV files. Import the data into a spreadsheet and compare the list of encountered IP addresses with the records from your DHCP server to spot abandoned IP addresses.

This is a very simple tool, but its focus on the most important information that network administrators need from a ping scan explains its popularity. The website for Advanced IP Scanner states that the tool has been downloaded by 30 million users.

Who is it recommended for?

If you need to access the devices that the scanner discovers, you will probably prefer this tool to the Angry IP Scanner. You still need credentials to log in to those remorse devices and if you know all your endpoints so well, you wouldn’t need a scanner to find out what’s on the network.

8. SolarWinds Switch Port Mapper with Engineer’s Toolset

SolarWinds is a leading network software producer and the Switch Port Mapper tool is part of one of the company’s network management packages. The Engineer’s Toolset contains more than 60 tools for monitoring and managing a network and this pack includes the Switch Port Mapper and Ping Sweep.

Key Features:

• Comprehensive Network Suite: Offers a broad range of network management tools, including the Switch Port Mapper for effective device discovery and management.
• Efficient IP Address Mapping: Automatically identifies devices connected to each switch port, simplifying network management and troubleshooting.
• Exportable Sweep Results: Allows easy export of sweep results in various formats, facilitating documentation and analysis.
• Intuitive User Interface: Designed with a user-friendly interface for straightforward operation and data input.
• Real-time Performance Insights: Provides insights into port activity and latency, aiding in the identification of network issues.

Why do we recommend it?

SolarWinds Switch Port Mapper is part of the Engineer’s Toolset, which provides a suite of system management utilities. This tool provides an alternative to Ping. It locates each switch and performs a query, returning the details of the connections to each port. The Engineer’s Toolset also provides a Ping Sweep tool.

The interface is very straightforward; just enter a range of IP address addresses to scan. You can specify a broad range if you are unsure of the total scope of addresses in use. By feeding in a text file with a list of IP addresses, you can extract a list of all the IP Addresses that have been allocated from a DHCP server.

Once you launch the search, the tool lists all of the active IP addresses it finds on the network. The sweep results can be exported as a text file, a CSV file, XML file, or an HTML page. With this, you can import the list into a spreadsheet and compare it to the list from the DHCP server. Subtracting the Ping Sweep results from your DHCP results will give you a list of abandoned IP addresses that you can restore to the pool of available addresses in your DHCP server.

The Switch Port Mapper results show the time it took for each host to respond. The response time highlights traffic bottlenecks on your network or where individual pieces of equipment are experiencing performance problems. You also get the hostname of each detected device. Exporting the single IP addresses and hostnames enables you to compare the current list of hostnames to records from your DNS server and make sure the server’s report reflects the actual address status of your network.

Who is it recommended for?

The Engineer’s Toolset is full of utilities that any network administrator will find essential. However, the price of the package would probably be too much for small businesses. Therefore, this package is suitable for the network administrators working for mid-sized and large companies. The software installs on Windows Server.

Unfortunately, it isn’t possible to buy the advanced Switch Port Mapper tool alone. SolarWinds does offer a 14-day free trial of the tool. SolarWinds Switch Port Mapper with Engineer’s Toolset can be installed on Windows Server.

9. NetScanTools Basic Edition

NetScanTools comes in two versions. One of these is a paid version called NetScanTools Pro, and the other is a free system called NetScanTools Basic. The ad-supported Basic edition has a reduced set of features compared to the Pro package. The Ping Sweep tool is included in the Basic Edition.

Key Features:

• Versatile Editions: Available in both free and paid versions to cater to different user needs and budgets.
• Enhanced DNS Querying: Incorporates DNS resolution tools for thorough network analysis and troubleshooting.
• Address Range Scanning: Efficiently scans specified IP address ranges, providing detailed insights into network activity.

Why do we recommend it?

NetScan Tools Basic Edition is another free utility for Windows. This tool provides a number of hand utilities that includes a Ping sweep and a standard Ping. The interface provides optional host resolution and port scanning. It will show its responses from all the IP addresses it tries unless you limit results to just live devices.

The ping sweep utility, called Ping Scan, requires an IP address range as inputs to the search. Once the sweep is launched, the tool attempts to contact each of the addresses in the given range. The results for each IP address show the response time from the ping round trip and a status comment. You can exclude non-responding addresses and include the hostname for each address in the results.

The absence of a hostname for an IP address that was contacted points to a possible problem with the networks DNS server. Another tool in the NetScan Tools Basic package specifically queries the system DNS to check for errors. You can print or copy the sweep results and save them to a file.

Who is it recommended for?

This tool is an alternative to Angry IP Scanner. It doesn’t provide remote access like Advanced IP Scanner but it does include some other handy utilities, such as a DNS examiner and a Traceroute implementation. Anyone can use this tool without any technical skills.

The Pro edition of NetScan Tools has more utilities. You can buy it for $249 for one license and up to $2,255 for five licenses. Both NetScan Tools Basic and NetScan Tools Pro are designed to run on Windows 7, 8, and 10.

10. Pinkie

Pinkie is a handy free tool with a lot of other utilities in addition to its Ping Sweep. This set of tools is only available for Windows. You can download Pinkie here.

Key Features:

• Multi-Tool Integration: Bundles several useful network tools, including ping sweep, port scanner, and subnet calculator.
• Efficient Network Sweeping: Capable of quickly scanning entire networks or specified segments for active devices.
• Simple Result Export: Allows for easy export of scan results, aiding in documentation and further analysis.

Why do we recommend it?

Pinkie is another free utility for Windows. It contains several tools within one app and you access each through a tabbed interface. There is a Ping in the package as well as a Ping sweep tool. Port Scanning is offered in a separate tab. There is no version for Linux.

Start by specifying a starting address and the number of hosts that should be scanned. You can choose to only include live hosts in the results. In that case, the sweep will continue either until the number of active IP addresses has been encountered or until all of the network has been scanned. If you don’t specify the live host requirement, the tool will include abandoned addresses in the sweep host count.

The tool works quickly and lists each encountered live IP address, or every address in sequence until the maximum number of hosts has been reached. Each record contains the hostname and the response time, which is the ping round trip time.

You can save the results to a file by copying it to the clipboard. You then paste the records out of the clipboard into a file. This enables you to reconcile the results with a record extract from your DHCP server. The Pinkie bundle includes a straightforward Ping, a Traceroute, a port scanner, and a subnet calculator. The utility also includes a TFTP server.

Who is it recommended for?

Pinkie is very similar to NetScan Tools Basic Edition and Angry IP Scanner. If you are looking for a free Ping sweep tool for Windows, there is little to pick between them. Choose any of these free tools if you are running Windows and need an easy way to scan the network.

11. Mitec Network Scanner

The Mitec Network Scanner is a system administration tool that includes a ping sweep utility. The free tool can be installed on Windows 7, 8, and 10 and Windows Server 2008, 2008 R2, 2012, 2012 R2 and 2016.

Key Features:

• Comprehensive Device Details: Delivers detailed information on discovered devices, including MAC addresses, hostnames, and response times.
• Whois and DNS Features: Includes Whois lookup and DNS resolution functions for enhanced network analysis and troubleshooting.

Why do we recommend it?

The Mitac Network Scanner is another free tool for Windows. However, this package has a few utilities that none of its rivals offers: the Active Directory scanner is a very useful tool and so is the software inventory facility. However, those device scanners operate on the host computer rather than across the network.

The ping sweep feature forms the heart of the Network Scanner. It gathers a list of live IP addresses within a given range. For each encountered address, you see that device’s MAC address, hostname, and response time, which represents the ping round trip time.

Other additional features in the tool let you explore each discovered device to deeper detail. This includes an inventory of the ports on the device and the manufacturer of that piece of equipment.

The Network Scanner is a useful tool that includes a Whois function and DNS resolution.

Who is it recommended for?

A small business owner would benefit from this tool. The device scanning systems in the package are good for businesses that have a handful of computers and then you still have the network scanning systems as well. Businesses with many computers will need remote monitoring systems that are worth paying for.

About Ping

Ping is a function of the Internet Control Message Protocol. It is available as a command-line utility on any computer connected to a network no matter what the operating system. Ping is so universal that it is a basic component of any network administrator’s toolkit.

Related post: Best network ping tools

Echo request and response

The classic ping command relies on a packet type that is specified in the ICMP definition. This is the “echo request,” which is replied to with an “echo response.” In order to work, Ping needs an address to which the echo request should be sent. That input value can be expressed as an IP address or as a host or domain name.

Entering an IP address for the destination gets you a direct RTT result. If you enter a hostname for a computer on the local network, the Ping routine will first have to go to the local DNS server to get the IP address that is connected to that name. If you are testing a connection across the internet, entering a domain name for the destination will force the Ping program to go and fetch the IP address of that domain’s web server before it can send the echo request. Issuing a ping with the IP address and then with the hostname or domain name will show you the delays caused by the DNS reference process.

Command-line utilities are not so popular these days. Many GUI adaptations of ping have been created by both individuals and software houses. Ping has a list of switches that alter its behavior. Each run of ping can only contact one address. The concept of a ping sweep can be implemented by a simple script that works through a list of addresses and issues the ping command for each.

The underlying functions of the software in this list are all variations of a script with a recursive loop, calling ping over and over again as it combs through the addresses in a given list.

Despite being a very old and very simple tool, Ping is very powerful. For example, simply reporting on a response from an address means that ping can be manipulated to detect IP addresses that are actually in use on a network. This is an essential requirement of any IP address management system.

The response time output field of ping is very useful. In a ping sweep, a troubled device shows a very long response time. If you test all of the devices on your network through a ping sweep, most devices will respond within a very close range of times. One or two high numbers in that Response Time column will instantly show when a device is overloaded or damaged.

Although ping is a straightforward and free utility, the developers who create variants such as a ping sweep deserve respect. The addition of graphical outputs, such a response timeline graphs, is also nice to see.

About Traceroute

Traceroute is a very similar networking tool to ping, but Traceroute uses UDP packets. Traceroute sends out a series of packets with the “time to live” field steadily increasing.

Time to live is usually abbreviated as TTL. It doesn’t contain a time value. Instead, it contains the maximum number of routers that the packet can pass through. When the packet reaches a router, that device reduces the TTL by one before it forwards it on to a neighboring router. If a router receives a packet that has a TTL of zero, it does not pass it on, which means that it drops it.

The ICMP protocol, which ping uses, includes an error messaging process that reports back on failure, giving the address of the device that reported the error. Traceroute uses this facility to log the address of the router that dropped the packet. By sending out packets with increasingly higher TTL values, the utility can eventually record the addresses of all the routers between the computer running the command and a given destination.

When used on a network, Traceroute can build up a map of all the routers on the LAN and how they link to each other and all of the other devices on the network. It would be possible to write a recursive routine including a Traceroute execution within the loop, giving an IP address as a parameter. The loop would cycle through a range of standard network IP addresses and report back on the route through the LAN to reach it.

On Unix-like systems, including Linux flavors and Mac OS, the command for Traceroute is traceroute. On Windows, the command is tracert.

A combination of Ping and Traceroute enables you to build a map of your network. Some of the ping sweep utilities listed in this guide use this exact combination to provide graphical representations of the network under investigation.

Related post: What is Matt’s TraceRoute?

Port mappers

Port mapping tools are also very useful. These use both TCP and UDP to check whether each port on a device is open.

Ping operates at the Internet Layer of the TCP/IP protocol stack, so it has no concept of port numbers. If you get a ping sweep tool that reports on the ports on a device as well as the device’s status, then that ping sweep has been performed with a combination of protocols that add to the small amount of information available to ping.

Unfortunately, knowledge of which ports are open is a security weakness and so some system administrators block their gateway device from sending ICMP each response in order to reduce the risks created by port scans.

Many operating systems prevent access to ICMP functionality to users who don’t have admin privileges. In these cases, it is common to use a higher-level version of the ICMP echo request, by sending a UDP datagram instead. This is what is often called the “UDP packet Ping,” which operates at the Transport Layer.

Ping sweep alternatives

A ping sweep utility can also be called an IP address tracker. Both of these types of software perform the same task: identify all of the IP addresses in use on a network. If you need more detailed information on IP address usage on your network, step up to a more complex tool. In this instance, the tool you seek is an IP address manager.

Ping sweep operations

A ping sweep is more appropriate for a small network. As your network grows, you may find that the manual steps needed to analyze data from a ping sweep takes up too much time. If this is the case, then your network is probably too big for a ping sweep to be a time-saving utility, and you should investigate IP address managers instead.

Do you perform ping sweeps on your network? Which tool do you use? Have you compared the ping sweep with a full IP address manager? Which do you prefer? Leave a message in the Comments section below and let us know your experience.

Ping sweep FAQs