> ## Content Index > Fetch the complete content index at: https://www.pinglabz.com/llms.txt > Use this file to discover other available public pages before exploring further. # fping Command: Ping a Subnet or Range, and the Policer That Faked 40% Loss - URL: https://www.pinglabz.com/fping-command-examples/ - Published: 2026-11-11T17:04:27.000Z - Updated: 2026-11-11T19:48:01.000Z - Description: fping -g sweeps a /24 in seconds. Through a 64 kbps ICMP policer, its 10 ms default interval reported 20% to 40% loss on 13 of 21 healthy hosts while the router counted 203 drops. At -i 20: 0% loss, 0 drops. Commands, output and the math. - Author: Jaime - Tags: Linux, Ping, ICMP, Kali Linux, Tools To ping a whole subnet with fping, use `-g` with a CIDR or a start and end address: `fping -g 198.51.100.0/24` prints `is alive` or `is unreachable` for every address, `-a` lists only the live ones, and `-u` only the dead ones. Add `-s` for a summary, `-c 5 -q` for per-host loss and RTT, and `-f hosts.txt` to read targets from a file. fping sends to the next target without waiting for the last one to answer, so a /24 takes seconds instead of minutes. The exit code is 0 only when every target answered. That speed has a cost I measured. Through a 64 kbps ICMP policer on an IOS XE router, `fping -q -c 5 -g 198.51.100.0/24` at its default 10 ms interval reported 20% to 40% loss on 13 of 21 healthy hosts. The router counted 203 dropped echo requests. The same sweep at `-i 20` showed 0% loss on all 21, and the policer dropped nothing. The loss was the policer, not the hosts. Part of the [Linux Networking Commands: The Complete Guide](https://www.pinglabz.com/linux-networking-commands/). Scope: fping 5.1 on Ubuntu 26.04 (Kali ships the same tool), one Cisco IOS XE 17.18.2 router and 20 target addresses built in my home lab on documentation ranges. ![Lab diagram. fp-host 192.0.2.10 sweeps 198.51.100.0/24 through FP-R1, which polices ICMP echo requests at 64 kbps inbound on Ethernet0/1. 20 live hosts at 198.51.100.10 to .29 plus the router. Cards show 21 alive found, 13 of 21 live hosts with false loss at the default interval, 0 of 21 at -i 20, and the policer counters 1,067 conformed and 203 exceeded.](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/11/fping-icmp-policer-false-loss-diagram.png) One host, one ICMP policer, 21 live addresses. The default interval fakes loss; -i 20 doesn't. ## How fping differs from ping [ping](https://www.pinglabz.com/ping-timeout-vs-unreachable/) handles one target at a time and waits for each reply. fping takes many targets, sends to them in a round-robin, and tracks the replies as they come back. A dead address costs one timeout in parallel with everything else, not one timeout after another. That makes it the tool for sweeps, for scripts that need a clean exit code, and for monitoring systems that check hundreds of hosts every minute. Smokeping and several NMS platforms use it for exactly that. ## Step 1: Install fping ```bash sudo apt install fping fping -v ``` ```text fping: Version 5.1 ``` Kali includes it. On Debian and Ubuntu it runs as a normal user; on RHEL-family systems install it from EPEL. ## Step 2: Ping one or several hosts ```text $ fping 198.51.100.10 198.51.100.10 is alive $ fping -e 198.51.100.10 198.51.100.2 198.51.100.10 is alive (1.30 ms) 198.51.100.2 is unreachable ``` `-e` adds the round-trip time. The second address doesn't exist, and the run exits with code 1\. Scripts can rely on that: 0 means all targets answered, 1 means at least one didn't, 2 means a name didn't resolve: ```text $ fping no-such-host.invalid no-such-host.invalid: Name or service not known [exit code 2] ``` ## Step 3: Ping a subnet or range `-g` generates the target list. It skips the network and broadcast addresses of a CIDR: ```text $ fping -a -g 198.51.100.0/27 198.51.100.1 198.51.100.10 198.51.100.11 ... 198.51.100.29 ``` 21 lines: the router and 20 hosts. A start and end address works too, and `-u` flips the output to the dead addresses: ```text $ fping -a -g 198.51.100.8 198.51.100.15 198.51.100.10 198.51.100.11 198.51.100.12 198.51.100.13 198.51.100.14 198.51.100.15 $ fping -u -g 198.51.100.0/28 198.51.100.2 198.51.100.3 ... 198.51.100.9 ``` To ping a list of hosts from a file, one per line, use `-f`: ```text $ fping -f hosts.txt 198.51.100.10 is alive 198.51.100.11 is alive 198.51.100.2 is unreachable ``` ## Step 4: Read the summary `-s` prints totals after the sweep. With `-q` it prints only the totals: ```text $ fping -q -s -g 198.51.100.0/27 30 targets 21 alive 9 unreachable 0 unknown addresses 36 timeouts (waiting for response) 57 ICMP Echos sent 21 ICMP Echo Replies received 0 other ICMP received 1.04 ms (min round trip time) 1.27 ms (avg round trip time) 1.47 ms (max round trip time) 4.361 sec (elapsed real time) ``` The math tells you how fping works. Each live host answered the first echo. Each of the 9 dead addresses got the first echo plus 3 retries, so 21 + 9 × 4 = 57 echos and 9 × 4 = 36 timeouts. Retries back off (`-B`, default 1.5), which is why 30 addresses took 4.4 seconds. ## Step 5: Measure loss and latency `-c` sends a fixed number of echos to every target and prints each reply, then a per-host line: ```text $ fping -c 5 198.51.100.10 198.51.100.11 198.51.100.10 : [0], 64 bytes, 1.25 ms (1.25 avg, 0% loss) 198.51.100.11 : [0], 64 bytes, 0.973 ms (0.973 avg, 0% loss) ... 198.51.100.10 : xmt/rcv/%loss = 5/5/0%, min/avg/max = 1.25/1.35/1.55 198.51.100.11 : xmt/rcv/%loss = 5/5/0%, min/avg/max = 0.973/1.20/1.37 ``` `-q` keeps only the per-host lines, which is what monitoring scripts parse. `-p` sets the gap between echos to the same host in milliseconds: ```text $ fping -q -c 20 -p 100 198.51.100.10 198.51.100.10 : xmt/rcv/%loss = 20/20/0%, min/avg/max = 0.937/1.22/1.47 ``` `-C` prints every RTT in one row per host, the format Smokeping reads: ```text $ fping -C 3 -q 198.51.100.10 198.51.100.11 198.51.100.10 : 1.27 1.43 1.47 198.51.100.11 : 1.03 1.19 1.36 ``` ## Lab: fping through an ICMP policer Policing ICMP is normal, whether it's [CoPP](https://www.pinglabz.com/control-plane-policing-copp/) on the router itself or a data-plane policer at a site edge. FP-R1 polices echo requests from the monitoring host to the target subnet at 64 kbps: ```text ip access-list extended FP-ICMP permit icmp host 192.0.2.10 198.51.100.0 0.0.0.255 echo class-map match-all FP-ICMP match access-group name FP-ICMP policy-map FP-POLICE class FP-ICMP police cir 64000 bc 2000 conform-action transmit exceed-action drop ! interface Ethernet0/1 service-policy input FP-POLICE ``` ### Alive detection survives A plain sweep of the /24 still found all 21 live addresses: `21 alive, 233 unreachable, 953 ICMP Echos sent` (21 + 233 × 4). The policer dropped 327 echos, but the retries to dead addresses absorbed most of the damage, and a live host only needs one of its four chances. ### Loss measurement does not Monitoring uses `-c`, and that changes the picture. I cleared the counters and sent 5 echos to every address in the /24 at the default 10 ms interval: ```text $ fping -q -c 5 -p 1000 -g 198.51.100.0/24 198.51.100.1 : xmt/rcv/%loss = 5/4/20%, min/avg/max = 0.409/0.597/0.945 198.51.100.10 : xmt/rcv/%loss = 5/4/20%, min/avg/max = 0.460/0.723/1.35 198.51.100.11 : xmt/rcv/%loss = 5/5/0%, min/avg/max = 0.414/0.632/1.28 198.51.100.12 : xmt/rcv/%loss = 5/4/20%, min/avg/max = 0.391/0.688/1.25 198.51.100.13 : xmt/rcv/%loss = 5/4/20%, min/avg/max = 0.415/0.638/1.21 ... ``` 13 of the 21 live addresses reported loss: 11 at 20% and 2 at 40%. The router showed where it went: ```text FP-R1#show policy-map interface Ethernet0/1 input Class-map: FP-ICMP (match-all) 1270 packets, 124460 bytes police: cir 64000 bps, bc 2000 bytes conformed 1067 packets, 104566 bytes; actions: transmit exceeded 203 packets, 19894 bytes; actions: drop ``` 1,067 + 203 = 1,270, exactly 254 targets × 5 echos. A capture on the host shows the dropped requests: Wireshark marks them `(no response found!)`, scattered across the hosts in round 2 and later, once the burst allowance ran out. ![Wireshark packet list of echo requests to 198.51.100.10 through .29. Round one all have replies; in round two, requests to 198.51.100.13 and 198.51.100.19 show no response found.](https://storage.ghost.io/c/ff/28/ff28db4a-11e1-4835-b928-158974cf96c1/content/images/2026/11/fping-no-response-found-wireshark.png) Echo requests to the live hosts. Round 1 is clean; from round 2 on, the policer starts dropping. A rerun with a capture running gave 11 of 21 hosts with loss, so the exact hosts change from run to run. The pattern doesn't: the loss follows the send rate, not the hosts. ## Fix: slow the interval to fit the policer Each echo request is 98 bytes on the wire, 784 bits. 64,000 / 784 ≈ 81 echos per second is the policer's budget. fping's default `-i 10` sends up to 100 per second. `-i 20` halves that: ```text $ fping -q -c 5 -i 20 -p 1000 -g 198.51.100.0/24 198.51.100.10 : xmt/rcv/%loss = 5/5/0%, min/avg/max = 0.462/0.532/0.636 198.51.100.11 : xmt/rcv/%loss = 5/5/0%, min/avg/max = 0.505/0.572/0.703 198.51.100.12 : xmt/rcv/%loss = 5/5/0%, min/avg/max = 0.440/0.558/0.607 ... conformed 1270 packets, 124460 bytes; actions: transmit exceeded 0 packets, 0 bytes; actions: drop ``` All 21 live hosts at 0%, nothing exceeded. If your monitoring server shows a flat 1% to 5% loss on many unrelated hosts at once, check for an ICMP policer or CoPP between the poller and the targets before you open tickets for each host. ## fping vs ping vs nmap -sn | | fping | ping | nmap -sn | | --------------------------- | ------------------------------------ | ------------------- | ----------------------------------------------- | | Targets per run | Many: list, file, range or CIDR | One | Many | | Probes | ICMP echo only | ICMP echo only | ICMP echo, TCP SYN/ACK, ARP on the local subnet | | Per-host loss and RTT stats | Yes (\-c, \-C) | Yes, one host | No | | Script-friendly exit code | 0 all alive, 1 some down, 2 bad name | 0 or 1 for one host | No per-host code | | Finds hosts that block ICMP | No | No | Often, via TCP probes | For discovery when ICMP is filtered, use [nmap host discovery](https://www.pinglabz.com/nmap-host-discovery/). For loss and latency on many hosts, fping is the better tool. ## fping command cheat sheet | Option | What it does | Example | | ------------- | ------------------------------------------------------- | ---------------------- | | \-g | Generate targets from a CIDR or start and end | \-g 198.51.100.0/24 | | \-f | Read targets from a file | \-f hosts.txt | | \-a, \-u | Show only alive, or only unreachable | \-a -g 198.51.100.0/24 | | \-e | Show elapsed RTT | \-e host | | \-s | Summary statistics at the end | \-q -s -g ... | | \-c, \-C | N echos per target, with per-host stats or all RTTs | \-q -c 5 | | \-i | Interval between any two packets, ms (default 10) | \-i 20 | | \-p | Interval between echos to one target, ms | \-p 1000 | | \-r, \-t, \-B | Retries (default 3), initial timeout ms, backoff factor | \-t 100 -r 1 | | \-q | Quiet: summaries only, exit code still set | \-q host1 host2 | | \-b, \-O | Payload size, ToS byte | \-b 1400 -O 184 | ## Gotchas - **Loss that moves between hosts.** A policer or CoPP in the path. The default `-i 10` sent 100 echos per second into a policer that allowed about 81, and 13 of 21 healthy hosts showed loss. - **Exit code 1 on a "successful" sweep.** Any unreachable target sets it, and a sweep of a partly used subnet always has some. Test for it in scripts with `-a` and count the lines, not the exit code. - **`-q` prints nothing without `-c` or `-s`.** `fping -q 198.51.100.10 198.51.100.3` printed no lines and exited 1\. Only the exit code is left. - **`Name or service not known`** with exit code 2 means DNS, not reachability. - **Sweeps feel slow on mostly empty subnets.** Every dead address gets 4 tries with backoff. `-r 1 -t 100` cut it down for a LAN where replies take under a millisecond. ## FAQ ### How do I ping a range of IP addresses in Linux? `fping -a -g 198.51.100.10 198.51.100.50` prints the live addresses between the two. Use a CIDR instead of two addresses for a whole subnet. ### How do I ping a whole subnet? `fping -a -g 198.51.100.0/24`. Add `-q -s` for a count of alive and unreachable addresses. ### What is the difference between fping and ping? ping tests one host and waits for each reply. fping tests many hosts in parallel, prints a line per host, and returns an exit code that says whether all of them answered. ### Why does fping show packet loss when ping doesn't? fping sends much faster. Something in the path that limits ICMP, like CoPP or a policer, drops the excess. In the lab, a 64 kbps policer dropped 203 of 1,270 echos at the default interval and none at `-i 20`. ### How do I ping a list of hosts from a file? `fping -f hosts.txt`, one address or name per line. Combine with `-a` or `-u` to filter the output. ### Is fping installed on Kali Linux? Yes. On Debian or Ubuntu run `sudo apt install fping`. ## Key takeaways - `fping -a -g` with a CIDR or a start and end address is the fastest way to list live hosts in a subnet. - Read `-s` output with the math in mind: live hosts cost one echo, dead ones cost four. - fping's 10 ms default interval can outrun an ICMP policer. Here it faked 20% to 40% loss on 13 of 21 healthy hosts while the router counted 203 drops. - Size `-i` to the path. At `-i 20` the same sweep showed 0% loss and 0 drops. **More in this series:** [How to Use masscan](https://www.pinglabz.com/masscan-commands-examples/) for a high-rate port scan that also ran into a policer, and [arpwatch](https://www.pinglabz.com/how-to-use-arpwatch/) when a host is up but two MACs are answering for the same IP. **Related:** [Ping Timeout vs Unreachable](https://www.pinglabz.com/ping-timeout-vs-unreachable/) · [nmap Host Discovery](https://www.pinglabz.com/nmap-host-discovery/) · [Control Plane Policing (CoPP)](https://www.pinglabz.com/control-plane-policing-copp/) · [How to Use hping3](https://www.pinglabz.com/how-to-use-hping3/) · [How to Use Wireshark](https://www.pinglabz.com/how-to-use-wireshark/) · **Series hub:** [Linux Networking Commands: The Complete Guide](https://www.pinglabz.com/linux-networking-commands/)