Why a Ping Sweep Misses Half Your Network: Silent Firewalls, Sleeping Laptops, and What ARP, nmap, and DHCP Leases Can't See

The new label printer in the shipping office needed an address, so someone pinged 192.168.10.57, heard nothing back, and typed that number into the printer's settings. By lunch the printer was dropping off the network every few minutes, and so was the computer in accounting that had used .57 for three years from behind a firewall that ignores ping by design. The person who picked the address ran the test almost everyone reaches for first when they want to know what is on a network, and the test gave a confident answer that happened to be wrong. On an ordinary office network, a ping sweep hears back from fewer than half the devices that are actually there, and the ones it misses include the most common computer in the building.

Every device on a network has an IP (Internet Protocol) address, the number other devices use to reach it, the way a street address lets mail find a house. Ping is the oldest tool for checking whether an address is in use. It sends a tiny message called an echo request using ICMP (Internet Control Message Protocol), a behind-the-scenes protocol that networks use for status and error messages, and any device that receives the request is expected to send back an echo reply. A ping sweep repeats that for every address in a range, usually the 254 usable addresses in a /24, a block of 256 written in the slash notation our visual guide to CIDR (Classless Inter-Domain Routing) explains, and writes down which ones answered. Think of it as knocking on every door on a street and noting who comes out. The trouble is built into the picture, because answering the door is optional. A house can be occupied by someone who never opens up for strangers or by someone asleep upstairs, and from the sidewalk both sound exactly like an empty lot.

The largest group of silent occupants on most office networks runs Windows. Windows 10 and Windows 11 include a built-in firewall, and the rule that would let a computer answer ping ships switched off. It switches on when someone turns on file and printer sharing for a network marked as private, or when an administrator enables it on every machine at once through group policy, the central settings system Windows offices use, and many offices never do either. So a Windows computer with default settings spends the day browsing, printing, and syncing files, and stays silent when pinged. Security software that brings its own firewall often blocks ping as well. Macs have a similar option, called stealth mode, in their firewall settings, but it ships turned off, so most Macs answer, as do most Linux machines, printers, and pieces of network equipment. One more obstacle sits between subnets: when a sweep runs from one subnet to count another, a router or firewall in the middle may drop the pings before they arrive, and a whole segment can look empty. Put those facts together and the most common computer in a typical office is invisible to the most common way of counting computers.

Luckily for anyone trying to count, a computer has to complete a second, quieter exchange before it can send a ping at all, and the Windows firewall doesn't police it. Inside a single subnet, devices hand traffic to one another by MAC (Media Access Control) address, the hardware identifier built into every network connection. Before your laptop can ping 192.168.10.57, it has to learn which MAC address belongs to that IP address, so it calls out to the whole subnet using ARP (Address Resolution Protocol), asking who has 192.168.10.57. The owner replies with its MAC address, and your laptop stores the pair in a short-term memory called the ARP table. The Windows firewall filters IP traffic, and ARP works one layer below IP, so the computer that is about to ignore the ping has already answered the ARP question. Run a sweep, disregard the ping results, read the ARP table afterward, and every firewalled machine on your subnet appears with its MAC address beside it. Our guide to tracing an IP address back to a physical device uses the same trick on a single address, and the one-liners below, from our scanning documentation, apply it to a whole /24.

Ping every address, then print the ARP table (swap 192.168.10 for your own network)

# macOS
for i in {1..254}; do ping -c1 -t1 192.168.10.$i >/dev/null 2>&1 & done; wait; arp -a

# Linux
for i in {1..254}; do ping -c1 -W1 192.168.10.$i >/dev/null 2>&1 & done; wait; ip neigh

# Windows (PowerShell)
1..254 | % { ping -n 1 -w 200 "192.168.10.$_" | Out-Null }; arp -a

These commands only send pings and read your own computer's table, so they change nothing on the network, and they are short enough to read in full before you run them. The output pairs each address with a MAC address, and setting it beside the ping results shows what the sweep alone would have missed.

What the ping sweep heard, next to what the ARP table recorded

address           ping       ARP table afterward
192.168.10.1      reply      a0:36:9f:1c:00:01    the gateway
192.168.10.23     reply      3c:22:fb:8e:41:90    a Mac
192.168.10.57     silence    d4:5d:64:a7:3b:12    a Windows computer, firewall on
192.168.10.88     silence    (no entry)           asleep, switched off, or unused
192.168.10.140    silence    70:85:c2:0f:9e:61    a Windows computer, firewall on

The ARP table has limits of its own. ARP never crosses a router, so a laptop on the office subnet learns nothing this way about the server subnet down the hall or the Wi-Fi network overhead; the router or firewall that serves each subnet keeps an ARP table for all of them, and asking it directly gets around the problem. The table also fades on a schedule that depends on who keeps it. A laptop forgets an entry within seconds or minutes, while many routers hold entries for hours (four hours by default on Cisco equipment), so a router's table can still list a laptop that left at lunch. A device that isn't awake to answer leaves no entry at all, and sleep is the second big reason a sweep comes up short.

Devices that sleep defeat ping and ARP alike. A laptop with its lid closed, a desktop that dozes after thirty idle minutes, and a phone in a pocket each hold an address and will want it back, and each is silent during the sweep. Phones are the most erratic. A phone on Wi-Fi keeps its radio off most of the time to save battery, so it may answer a ping after two seconds, or once in five tries, or only when someone picks it up, and a sweep with a short timeout like the commands above marks it absent. Battery-powered sensors and other IoT (Internet of Things) gadgets wake for a few seconds every few minutes to report in and spend the rest of the time unreachable. Some network cards bend the rule in the other direction, answering ARP on behalf of a sleeping computer through a power-saving feature called ARP offload, so a laptop can appear in the ARP table while ignoring the ping entirely. Other devices only exist at certain hours, like the night-shift workstation or the machine that wakes up for month-end processing. The 10 a.m. population of a subnet differs from the 3 a.m. population, which is why our guide to building an inventory for a network nobody documented recommends sweeping more than once, at different times of day.

The scanner most network engineers reach for is nmap (short for Network Mapper), a free tool that has been around for nearly thirty years. Its discovery scan, nmap -sn, skips the deeper port scanning nmap is known for and only asks which addresses are in use. When it runs with administrator rights on the same subnet it is counting, it asks by ARP instead of ping, so it finds the same firewalled Windows machines the ARP trick does, and it adds two helpful details: a name for each device that has one, looked up through DNS (Domain Name System, the internet's directory of names and addresses), and the manufacturer of each network card, read from the first half of its MAC address.

Without administrator rights, or when the subnet sits on the far side of a router, ARP is out of reach, and nmap falls back to knocking: a ping when it has the rights to send one, plus attempts to open connections on ports 80 and 443, the numbered entry points that web servers listen on, using TCP (Transmission Control Protocol, the method most internet traffic uses to open a connection). Even a refusal counts, because a device that answers a knock with "nothing here" has proven it exists. A Windows computer with default settings drops the knock without a word, so across a router it stays hidden unless you knock on a door it opens, such as port 3389 when Remote Desktop is turned on, or port 22 for SSH (Secure Shell, the remote login used by Linux machines and network equipment).

nmap's discovery scan, three ways

sudo nmap -sn 192.168.10.0/24
    same subnet, as administrator: asks by ARP, finds firewalled machines, adds names and makers
sudo nmap -sn 192.168.20.0/24
    another subnet: a ping plus knocks on ports 80 and 443
sudo nmap -sn -PE -PS22,443,3389 192.168.20.0/24
    another subnet: a ping plus knocks on SSH, the web, and Remote Desktop

The sudo at the front of each line runs the command with administrator rights on a Mac or Linux machine, and on Windows you get the same effect by opening the command prompt as an administrator. Without those rights, nmap can't run its ARP check or report MAC addresses. Our free ping tool and port scanner work by knocking too, for public addresses on the internet: they test from IPCraft's server whether a host accepts connections on ports like 80 and 443, and they come with the same caveat, since a host that filters those ports can look offline while running perfectly well.

DHCP (Dynamic Host Configuration Protocol) is the service that hands out addresses automatically, lending each device an address for a set period called a lease, and its lease table approaches the question from the opposite direction. Scans ask who is present right now, and the lease table lists who asked for an address recently. That gives it a strength no scan has, because a sleeping laptop still holds a current lease, so the table includes devices that are asleep, switched off for the night, or zipped into a bag, along with each one's MAC address and the name it gave itself. Each lease also records when it was granted or last renewed, and since an awake device renews its lease about halfway through, an old renewal time marks a device that has been asleep or away.

Two blind spots come with the lease table. Devices with addresses typed in by hand (servers, network equipment, many printers) never ask DHCP for anything, so they never appear, and our guide to DHCP, static addresses, and reservations explains why those devices belong in their own range of the subnet, partly for this reason. A lease also outlives the device that took it. The visitor's laptop that left yesterday keeps its lease for hours or days, and in the table it looks the same as a laptop asleep at its desk, a problem our guide to sizing Wi-Fi and guest subnets shows can empty an entire address pool. At home, the list of connected devices on your router's settings page is a lease table with a friendlier design, and it shares the same blind spot for anything given a fixed address, which in the plan from our guide to home lab addressing means the switches, the access points, and the Pi-hole.

A few kinds of devices hide from every method, and it helps to know them by name. NAT (Network Address Translation) lets one address stand in for many devices behind it, so a small Wi-Fi router someone plugged in under a desk, or a server running a dozen containers, appears as a single address with a single MAC address no matter how much sits behind it; our NAT explainer covers how that translation works. A device on a subnet you didn't scan stays invisible, and a VLAN (virtual local area network) can run several separate networks over the same switches, so the laptop doing the sweep sees only the one it is plugged into. Guest Wi-Fi with client isolation turned on stops devices from seeing each other at all, so a sweep from a guest laptop finds the gateway and little else. A device that is unplugged during the scan (the spare laptop in a drawer, the projector cart in a closet) shows up nowhere except in an old lease, if that lease hasn't expired yet. Every scan is a photograph taken at one moment from one spot on the network.

Here is how the methods compare on a single network. Picture a sixty-person office on one wired subnet, 192.168.10.0/24, at 10 a.m. on a Tuesday, with seventy-one devices holding addresses on it. Ten have hand-typed addresses and answer ping: the gateway, a file server, two printers, and six conference-room displays. Five printers and copiers get reserved addresses from DHCP, and twelve Macs, four Linux workstations, and thirty Windows computers in use get theirs from DHCP too. Two more Windows machines with hand-typed addresses run the lobby sign and the time clock, and eight computers that normally use DHCP sit asleep or switched off at empty desks. Run each method from a laptop plugged into that subnet, and the counts come out like this.

One office subnet, seventy-one devices, five ways of counting them

method                                found   missed
ping sweep                              31      40    32 Windows computers, 8 sleepers
ping sweep, then the ARP table          63       8    the sleepers
nmap -sn, as administrator              63       8    the sleepers; adds names and makers
DHCP lease table                        59      12    every hand-typed address; also lists 9 devices already gone
ARP table and DHCP leases together      71       0    17 lease-only entries: 8 sleepers, 9 gone

The sweep found thirty-one of seventy-one devices, about 44 percent, and each device it missed was holding a real address that someone could have handed out a second time. The ARP table recovered the thirty-two silent Windows machines, and nmap matched it exactly, since on its own subnet nmap was reading the same ARP replies. The lease table recovered the eight sleepers, and it also listed nine devices that went home yesterday, which one snapshot can't tell apart from the sleepers; their renewal times, or a second sweep the next morning, sort out which is which. ARP and DHCP together account for all seventy-one, because each one's blind spot is the other's strength: ARP sees the hand-typed addresses that never asked DHCP for anything, and DHCP remembers the sleeping devices that answer nothing. Swap the office for a warehouse full of handheld scanners, or a house full of phones and smart speakers, and the proportions change while the pattern holds.

The places where the sources disagree are where the useful findings live. An address in both the ARP table and the lease table is a healthy device on DHCP. An address in the ARP table with no lease was typed in by hand, and if no record of it exists anywhere, it is the next .57, which our guide to IP address conflicts explains how to catch before two devices start fighting over it. A lease with no matching ARP entry belongs to a device that is asleep or gone. A device whose MAC address differs from the one in your records deserves a look the same day, since it means either the hardware was replaced or two devices are sharing the address. Before reusing any address that looks free, check more than the ping: look for it in the router's ARP table and the lease table, and check when its record says it was last seen. Proving an address is truly empty takes patience, which is why our renumbering playbook waits for an old range to stay silent through a full cycle of scheduled work before reclaiming it.

Everything above assumes IPv4 (Internet Protocol version 4), the familiar four-part addresses like 192.168.10.57. On IPv6 (Internet Protocol version 6, the newer system with much longer addresses), a ping sweep is out of the question, because one standard IPv6 subnet holds about eighteen quintillion addresses, and pinging a million of them per second would take more than half a million years. Discovery there leans on the passive sources instead. The neighbor table is IPv6's version of the ARP table, shown by ndp -an on a Mac and ip -6 neigh on Linux, and where the network runs DHCPv6, the IPv6 version of DHCP, its leases help too, though many devices choose their own IPv6 addresses without asking any server. Our guide to IPv6 address planning explains why the subnets are that large on purpose.

A count only helps if it ends up somewhere the next person can find it. In IPCraft, an IPAM (IP Address Management) system, every subnet has a Scan button that accepts the output of any method in this post: the ping-and-ARP one-liner, nmap's results, a lease export from Windows Server, Kea, or dnsmasq (the DHCP server inside Pi-hole and many home routers), or a router's client list. IPCraft works out the format on its own, and you can paste several at once, such as the ARP output followed by the lease file, which merges them by address into the combined view that came out on top in the example. The preview sorts everything into three groups: records the scan confirmed, live devices with no record, and records the scan didn't see. Applying it stamps a last-seen date on every documented address that appeared, fills in a missing hostname or MAC address, flags any record whose MAC address differs from the one the scan found, and can create records for the undocumented devices. It never deletes a record, because a device that didn't show up may only be asleep. Pasting again the next day at a different hour duplicates nothing, so the morning and evening sweeps build one picture, and the scanning documentation lists the commands for every operating system and the full set of supported formats.

Back in the shipping office, the fix took two minutes once someone found the conflict, and prevention would have taken less. If the record for .57 had shown a MAC address and a last-seen date from that morning, or if the person choosing it had read the ARP table after the ping, the label printer would have gotten a free address and accounting would never have noticed. Ping answers one question well: whether a device at an address is willing to reply right now. The question people use it for, whether an address is in use, takes the ARP table, the lease table, and a record that remembers what both of them saw.