How to Scan a Network for IP Addresses (Step by Step)

To scan a network for IP addresses, find your subnet with ipconfig or ip addr, ping or ARP-sweep every address in that range, then resolve hostnames with nslookup. For repeatable results across many subnets, use Nmap or an automated discovery platform instead of manual commands.

Knowing which addresses are in use is the first step in troubleshooting conflicts, finding rogue devices and planning capacity. On a small office network you can do it with built-in commands in a few minutes. On a larger estate you need scheduled discovery that records results over time.

Private networks normally use the ranges reserved in IETF RFC 1918, and subnet notation follows RFC 4632. Only scan networks you own or are authorized to test. For command-line scanning we use Nmap, the free and widely used open-source scanner.

Method	Platform	Finds	Limits
ipconfig / ip addr	Windows / Linux	Your own address, mask and gateway	Local host only
arp -a	Windows, Linux, macOS	Devices your machine recently talked to	Misses silent devices
ping sweep	All	Hosts that answer ICMP echo	Blocked by firewalls on some hosts
nslookup	All	Hostnames for known addresses	Needs DNS records
Nmap -sn	All	Live hosts and MAC vendors on the LAN	Needs install and permission
Discovery platforms	Server or cloud	Inventory, history and alerts	Cost and setup

Step 1: Find Your Subnet

Run ipconfig on Windows or ip addr on Linux to read your IPv4 address and subnet mask, which define the range you will scan. For example, 192.168.1.25 with mask 255.255.255.0 means the subnet 192.168.1.0/24.

Note the default gateway too, since it is usually the router and a good test target. The number of usable host addresses in a subnet follows this formula:

Usable hosts = 2^{(32 − prefix length)} − 2

For a /24 prefix that gives 2⁸ − 2 = 254 usable addresses. The subtraction removes the network and broadcast addresses.

Step 2: List Known Devices With ARP

The arp -a command lists IP and MAC address pairs your computer has recently resolved on the local network. It is the fastest way to see neighbors, but it only shows devices your machine has contacted.

Run arp -a after pinging the gateway and a few hosts to populate the table. Each entry shows whether the address is dynamic (learned) or static (configured). The ARP protocol itself is described in RFC 826.

Step 3: Run a Ping Sweep

A ping sweep sends ICMP echo requests to every address in the range and records which ones reply. It is simple and universal, but hosts that block ICMP will appear offline even when they are active.

On Windows you can loop over the range from Command Prompt:

for /L %i in (1,1,254) do @ping -n 1 -w 200 192.168.1.%i | find "TTL="

On Linux or macOS, nmap -sn 192.168.1.0/24 performs a similar sweep and also uses ARP on the local segment, which finds devices that ignore ping. The ICMP protocol is defined in RFC 792.

Step 4: Resolve Names and Identify Devices

Use nslookup to turn IP addresses into hostnames, and read MAC address prefixes to identify the manufacturer. Together they help you decide whether an unfamiliar address is a printer, a phone, a server or something that should not be there.

Run nslookup 192.168.1.50 to query reverse DNS.
Compare the MAC prefix with the vendor reported by Nmap.
Check DHCP lease tables on the router or server for hostnames and lease times.
Match findings against your asset inventory and flag unknown devices.

When to Move to Automated Discovery

Manual commands stop scaling when you have multiple subnets, VLANs or remote sites. Automated discovery platforms scan on a schedule, store history and alert on new or missing devices, which command-line scans cannot do on their own.

Several products in the SaaSPodium directory include discovery and inventory. Browse the Network Monitoring Software category and compare:

Auvik: cloud-managed network discovery and automatic topology maps.
SolarWinds Network Performance Monitor: enterprise monitoring with discovery for large multi-vendor networks.
ManageEngine OpManager: network and server discovery with a freemium entry edition.
Lansweeper and Device42: IT asset discovery that records what is on the network and its relationships.

Related reading: our free IP scanners guide and ping sweep tools comparison.

Troubleshooting and Good Practice

If a scan looks wrong, check the subnet, firewall rules and permissions before assuming devices are missing. Scan at quiet times, keep a record of results and always have written authorization for any network you do not own.

Missing hosts: host firewalls often block ICMP, so cross-check with ARP.
Duplicate addresses: two devices with one IP appear as changing MAC entries in the ARP table.
Wrong results: VPNs and virtual adapters can make you scan the wrong subnet.
Security: unauthorized scanning can violate policy or law, so document approval.

Frequently Asked Questions

What is the fastest way to scan a network for IP addresses?
Nmap with the ping-scan option, for example nmap -sn 192.168.1.0/24, is the quickest on a small LAN because it uses ARP and ICMP together. Built-in ping and arp commands are slower but need no installation.

Is it legal to scan a network for IP addresses?
Scanning networks you own or have written authorization to test is normal IT practice. Scanning other people's networks without permission may break policy or local law, so always document approval first.

When should I buy IP discovery software instead of scanning manually?
Consider software when you manage several subnets or sites, need scheduled scans, change history or alerts for new devices, or must feed an asset inventory. Manual scans work for a single small network.

How to Scan a Network for IP Addresses: Command-Line Steps, Nmap and Discovery Platforms