I know that this question was asked a lot, but all the answers given are with the ping scan of nmap nmap -sP The problem with this scan is that it doesn't detect hosts that doesn't reply to ping (like phones).

I used to use nessus to scan, and i see that it really gives all up hosts in the local network.

So how can i discover all up hosts in a local network with nmap without using the ping scan ?


You can utilize the -Pn option in Nmap. This will skip the ping scan and automatically classifies the asset as "UP", because you have told Nmap that all assets are up. Nmap can then continue with further discovery of that asset.

  • If i use this option, all the addresses from 1 to 255 will be shown as up. – Sidahmed Jan 31 '16 at 13:56
  • Have you tried it yet? I just did a scan and it only showed devices on the network, not empty ip's on the subnet. – NobleMan Jan 31 '16 at 13:59
  • Yeah, I have just tried it, and it shows me that all the addresses are up (it's not the case, I'm sure 100%) – Sidahmed Jan 31 '16 at 14:07
  • Take a look at this section on Nmaps site. They show you all the parameters you can use to discover the devices on the network. nmap.org/book/man-host-discovery.html – NobleMan Jan 31 '16 at 14:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.