Ping Sweep: Finding Live Hosts With Bash and Nmap
Find every live host on a subnet with a bash one-liner, and when to reach for nmap -sn instead. Why a down result never means the address is free.
Find every live host on a subnet with a bash one-liner, and when to reach for nmap -sn instead. Why a down result never means the address is free.
The iputils ping flags engineers actually use: -c/-i/-q for jitter, -s/-M for MTU, -D for timestamps, and the -I flag that fixes confusing IPv6 failures.
Find the path MTU with nothing but ping, from Linux and IOS XE, against a real 1400-byte link. The 28-byte math and the PMTUD black holes that hang TCP.
Source interfaces, the DF bit, repeat counts, and the response characters (! . U M) that tell you exactly what failed. Extended ping on Cisco IOS XE, captured live.
Silent 100% loss and Destination Unreachable are different failures pointing at different problems. Every ping failure message decoded with live lab captures.
What actually happens between typing ping and the reply line, decoded field by field on a live 3-hop Cisco lab: ICMP echo, TTL, RTT, and jitter.
SD-WAN routing confuses people because there are really two routing problems happening at once, and they are easy to mix up. There is the routing inside the SD-WAN fabric - how sites learn each other's prefixes across
A wireless LAN controller, or WLC, is the device that turns a pile of access points into a managed wireless network. Without one, every access point is an island you configure and troubleshoot by hand. With one, the access points
A scan you cannot reproduce is a story, not evidence. The moment an Nmap result matters - a firewall change you signed off on, a rogue service you found on a production VLAN, an asset inventory the audit team will lean
Timing is the lever that decides whether an Nmap scan finishes before your coffee gets cold or runs so slowly it slips under an intrusion-detection sensor. When you are sweeping a /16 for an asset inventory, you want every
Nmap ships a whole family of options with names like fragmentation, decoys, and source-port spoofing, and it is easy to read that list as an attacker's cheat sheet. Flip the framing. As the engineer who owns the
By the time you have found an open port and identified the service behind it, you have answered "what is listening here?" but not "what can it tell me about itself?" That second question is where