Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am a host in a subnet - conforming to RFC1918.

What ways are possible (without iterating over the 254 addresses) to map the IPEndPoints in my local subnet?

share|improve this question

nik is close; you do need to ping the broadcast, but not all systems will respond directly.

Note the broadcast address is not the same as your network address. If your IP is, and your netmask is, then your network address is and your network broadcast address is

  1. Ping the broadcast of your network:

    • Linux: ping -b
    • WinXP: ping

  2. Check the ARP cache for responses:

    • Linux: arp
    • WinXP: arp -a

Oddly enough, I get responses from a Win-7 machine on my network when pinging the broadcast address, but no one else's responses show up. There are 4 devices on my network (router, XP, Win7, debian); all 3 remote machines are listed correctly in the arp output when I ran the above commands on both the Debian and WinXP systems.

share|improve this answer
but are they listed if you clear the arp cache first? (I think it's: arp -d *) – fluxtendu Feb 19 '10 at 12:18
+1, @quack, you are right. For some local reasons I did not actually try this out on my network (this would be detected as a 'scan' on my network :-). Ping to the broadcast address is a better option. Tho, the network address will also work on some variants (I checked from a linux machine). – nik Feb 19 '10 at 12:22
@fluxtendo +1, thanks, i wondered about that. yes, the winxp system shows the arp cache cleared, and after pinging the broadcast address the arp cache is populated correctly again. (the debian system seems to refresh its arp cache too quickly to test.) – quack quixote Feb 19 '10 at 12:28
@nik: yes, the linux system claims to be pinging to broadcast when i tried the network address, but that odd response from the Win-7 machine only happened when i pinged the broadcast. on winxp, pinging the network address results in "Destination specified is invalid." – quack quixote Feb 19 '10 at 12:29
i was wrong, the Win-7 machine was off. it was a freakin' iPod Touch responding. go figure. – quack quixote Feb 19 '10 at 17:56

If you send a broadcast ping with,

ping network_address -b 

where network_address is your equivalent class-c network.
All the endpoints will reply to you.
You then just have to extract unique individual responding IP addresses from the output.

This means, if your IP address is in a Class-C network.
You would do a ping -b and look at (say) a minute worth of output.
All connected end-points in the network will reply to this broadcast address.

share|improve this answer
winxp's ping doesn't seem to support pinging a broadcast address, and nobody responds when i try it from my debian system. (there are 3 machines on the local network that all respond to a direct ping.) – quack quixote Feb 19 '10 at 11:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.