fping

OVERVIEW

fping (fping.org, schweikert/fping on GitHub) sends ICMP echo requests to a list or range of hosts and reports which ones respond, the same job as ping, but built from the ground up to handle many targets at once instead of one host per invocation: it interleaves probes to all targets so a sweep of hundreds of hosts finishes about as fast as the slowest single one, not the sum of them.

It has been a standard network-diagnostics utility since 1992, and on an engagement it typically runs before Nmap or masscan, simply to trim a large CIDR range down to the subset of hosts actually worth spending scan time on.

USE CASES

Practical use cases

• 01

  Trimming a large CIDR range down to only the hosts that actually respond before running Nmap or masscan.

• 02

  Confirming a specific host is up and reachable before troubleshooting why a scan against it returned nothing.

• 03

  Monitoring host liveness across an engagement to catch systems that go up or down mid-test.

• 04

  Building a quick, low-overhead network inventory as the very first step on a new scope.

QUICK START

At the very start of a network-scoped engagement, to get a fast list of which hosts in the range actually respond before running anything heavier.

1. Confirm ICMP probing across the target range is inside the agreed scope.
2. Install fping (most package managers ship it, e.g. apt/brew install fping).
3. Run it against the range with -a to print only responsive hosts, and -g to generate the range.
4. Feed the resulting live-host list into Nmap, masscan, or your next enumeration step.

fping -a -g 10.10.10.0/24 2>/dev/null

BEFORE YOU RUN IT

What to check before running it