Discover live hosts on a subnet with nmap -sn

Run a ping sweep that lists online machines without wasting time on port scanning — the forgotten first step of any network audit.

LinuxnmapdiscoveryscanMedium risk

Run `sudo nmap -sn 192.168.1.0/24` to list every live host on the subnet with its MAC vendor, skipping the port scan entirely.

01Command

Command

$ sudo nmap -sn 192.168.1.0/24

02What it does

A full `nmap 192.168.1.0/24` scans 1000 ports per host and can take minutes; `-sn` stops after host discovery, returning in seconds. With root privileges on a local subnet Nmap uses ARP requests, which are far more reliable than ICMP and also reveal the MAC vendor — handy for identifying IoT devices. Add `--min-rate 500` on large subnets to speed the sweep up.

03Risk

RiskMedium risk

Requirementsnmap installed; root for best discovery accuracy on local network

!Warning: Only scan networks you own or have permission to test — discovery sweeps are legally treated like any other network probing.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

Host Discovery — Nmap Reference Guide
nmap.org · vendor-doc · 2026-09-17
Evidence: Documents -sn (ping scan, no port scan) and default discovery probes per target type.

Last verified: 2026-09-17 · Category: Network