Pearson's OSCP Notebook

fping

Properties1
tagsfping, ping-sweep, host-discovery, icmp, enumeration, networking

3 min read

fping — Host Discovery Reference

What is fping?

fping is a command-line tool that sends ICMP echo requests to multiple hosts simultaneously — much faster than the standard ping for host discovery across subnets. Available on Linux by default; installable on Windows.

OSCP use: First step after getting into a network — sweep the subnet to find live hosts before running Nmap against them.

Syntax

fping [options] [targets]

📌 1) All Flags

FlagDescription
-aShow only alive (responding) hosts
-uShow only unreachable hosts
-g <range>Generate target list from CIDR or range (192.168.1.1 192.168.1.254)
-f <file>Read targets from a file (one per line)
-c <N>Send N pings per host (default: 1)
-C <N>Send N pings and show per-ping statistics
-p <ms>Time in milliseconds between pings to the same host (default: 1000)
-i <ms>Time in milliseconds between pings to different hosts (default: 25)
-t <ms>Individual target timeout in milliseconds (default: 500)
-r <N>Retry limit — number of retries per host (default: 3)
-b <bytes>ICMP packet size in bytes (default: 56)
-sPrint final statistics summary
-qQuiet — only print summary, suppress per-host output
-eShow elapsed time for each response
-AShow IP address instead of hostname
-dUse DNS to resolve hostnames for output
-nSame as -d (resolve names)
-lLoop mode — ping hosts indefinitely
-DPrint Unix timestamp before each output line
-O <TOS>Set Type of Service field in ICMP packet
-I <iface>Bind to a specific network interface
-S <addr>Set source address
-4Force IPv4
-6Force IPv6

📌 2) Common Examples

Subnet sweep — show only alive hosts

fping -a -g 10.10.10.0/24 2>/dev/null

2>/dev/null suppresses the “ICMP Host Unreachable” errors for dead hosts, leaving only live IPs.

Range sweep (start IP to end IP)

fping -a -g 10.10.10.1 10.10.10.254 2>/dev/null

Sweep and save live hosts to file

fping -a -g 10.10.10.0/24 2>/dev/null | tee live_hosts.txt

Sweep from a target list file

fping -a -f targets.txt 2>/dev/null

Send 3 pings per host (more reliable on flaky networks)

fping -a -g 10.10.10.0/24 -c 3 2>/dev/null

Show alive hosts with response time

fping -a -e -g 10.10.10.0/24 2>/dev/null
fping -a -g 10.10.10.0/24 -s 2>/dev/null

Multiple subnets at once

fping -a -g 10.10.10.0/24 -g 192.168.1.0/24 2>/dev/null

Pipe live hosts directly into Nmap

fping -a -g 10.10.10.0/24 2>/dev/null | nmap -iL - -sV -p 22,80,443,445

📌 3) Windows Usage

fping is not built into Windows by default. Alternatives:

# PowerShell ping sweep (no fping needed)
1..254 | ForEach-Object {
    $ip = "10.10.10.$_"
    if (Test-Connection -ComputerName $ip -Count 1 -Quiet) {
        Write-Host "$ip is alive"
    }
}
 
# CMD for loop ping sweep
for /L %i in (1,1,254) do @ping -n 1 -w 100 10.10.10.%i | find "Reply" && echo 10.10.10.%i

📌 Quick OSCP Cheat Sheet (Copy/Paste)

# Standard subnet sweep
fping -a -g 10.10.10.0/24 2>/dev/null
 
# Save results
fping -a -g 10.10.10.0/24 2>/dev/null | tee live_hosts.txt
 
# Feed into Nmap
fping -a -g 10.10.10.0/24 2>/dev/null | nmap -iL - -sC -sV --open

Graph View

Backlinks