How can I determine if a certain machine exists on the network?

If I ping the IP address, would that be sufficient?

  • The correct answer depends on precisely how much you know about the machine and precisely how you define "exists on the network". (For example, if the machine is connected to the network and listening to broadcasts but never, ever sends anything at all, does it "exist on the network"?) – David Schwartz Sep 27 '11 at 5:57

No - a machine is not obliged to respond to a ping. To be certain, you need to ping from the local network the machine is on, then check for an arp response:

arp -a

If you see a mac address against the IP address, then the device exists. If not, then it is effectively not present (right now - it could just be powered off for the moment).

  • it is possible for a computer to ignore arp requests, it depends on how much a computer wants to hide. – bryan Sep 27 '11 at 4:52
  • 1
    @bryan Certainly - but if it ignores arp requests it is effectively not present, in that you could add another machine to the same network with the same IP and not get a conflict (unless it responds to some arp requests, but that is an edge case that can probably be be excluded from this scenario) – Paul Sep 27 '11 at 6:12
  • Hmm. Unaccepted - did this not work for you @YeJiabin? – Paul Oct 5 '11 at 23:43

Pinging is not enough. Many firewalls will block pings.

You could try nmap

nmap -PN

That attempts to discover host even if they are blocking ping scans.

  • 1
    Is there any better solutions? Thanks anyway. – YeJiabin Sep 27 '11 at 4:17
  • 1
    I am not sure why this answer was promoted. nmap -Pn in absense of any open ports will confirm the presence of a host by ARP response. It is the same as pinging it and checking your arp table, but without the need to install nmap. – Paul Sep 27 '11 at 6:18
  • @Paul not sure if you are right, but at my company's intranet nmap -PN shows the host while simply pinging and checking the arp table show nothing. – Pithikos Aug 20 '14 at 14:45
  • @Pithikos Interesting - ping + arp works here. If nmap was able to detect it, then the device must be responding to arp requests, so the question is why this response wasn't stored in the arp cache. – Paul Aug 21 '14 at 2:20

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.