What is a ping sweep (ICMP sweep)?
If a given address is live, it will return an ICMP echo reply. To disable ping sweeps on a network, administrators can block ICMP echo requests from outside sources. However, ICMP timestamp and Address Mask requests can be used in a similar manner. Whereas a single ping will tell whether one specified host computer exists on the network, a ping sweep consists of ICMP (Internet Control Message Protocol) echo requests sent to multiple hosts. To do this, the ping requires an address to send the echo request to, which can be an IP address or a web server domain name. A ping sweep (also known as an ICMP sweep) is a basic network scanning technique used to determine which of a range of IP addresses map to live hosts (computers). In addition to identifying active devices on a network, ping sweeps are also helpful at detecting unrecognized devices that may be malicious and ensuring devices are functioning correctly. Pinging is among the older and slower network security scanning methods available. However, they are still an effective means of auditing network management controls and ensuring the cybersecurity of an organization. There are a number of tools organizations can use to perform a ping sweep:  SolarWinds Ping Sweep  SolarWinds Ping Sweep tool for Windows allows users to scan a range of IP addresses as part of their network management protocols. This is done by uploading a text file that includes a list of IP addresses. Users can export results as a TXT, CSV, XML or HTML document. Network discovery results reveal the hostname of each device detected and the time it took to respond. This information alone can indicate performance issues that users can resolve through troubleshooting. It can also indicate potential malicious device activity when compared against those devices that are expected to be present on your DNS server. SolarWinds also offers an IP Address scanner that combines ICMP and Simple Network Management Protocol (SNMP) sweeping options that works with IPv4 and IPv6 address types. Paessler PRTG  Paessler PRTG is a system monitoring tool that maps networks and the devices connected to them, as well as the network performance overall. It is available on any operating system in use today. The program uses a command-line interface (CLI) to issue a ping query to one IP address at a time. To reach every node on a network, Paessler employs a ping command in a looped routine to sweep every network address available. If it receives a response, the response is recorded and additional inquiries can be used to investigate any suspicious network devices. Nmap  When a destination isn't reachable, the router responds with an ICMP message back to the ping sweep indicating so. Nmap is a free network system tool that, similarly to Paessler PRTG, executes from the command line. It can be installed on Windows, Mac OS, Linux and Unix, and can perform a scan with Transmission Control Protocol (TCP) or as a ping. The program provides the IP address of active hosts and their hostname. In TCP form, it can act as a port scanner and will indicate any open ports on each connected device or router. The raw output provided by the Nmap process can be difficult to read, but there are additional "reader" tools that can transform the data into easy-to-read records. Fping  Fping is another command-line tool available for Linux OSes. It works by uploading an IP address range and allows you to filter results by address types, active or inactive hosts and DNS records. Results provide the hostname, and whether or not a DNS address looks suspicious or reveals a missing record. Hping  Hping is also an ICMP ping command-line tool used heavily by senior network administrators who prefer using commands in either ping or a traceroute form. It can be installed on Windows, Mac OS, Linux or Unix. Its ping request function operates at the internet layer of a TCP/IP protocol. While it doesn't offer port visibility, TCP and User Datagram Protocol (UDP) functionality will allow users to conduct port scanning on connected computers and routers. This is a useful function if an organization frequently test firewalls within their systems. However, it should be noted this same reason makes port scanning popular with cybercriminals. Advanced IP Scanner  Advanced IP Scanner is another ping sweep tool for Windows that can scan a single or group of IP addresses. Results reveal any shared folders on any detected host, as well as the hostname, MAC address and manufacturer. Once it detects all live nodes, users can access the connected device and execute commands on it, as well as turn them on, off or put them on standby. They can save output files as CSV files, which makes it easy to compare listed IP addresses against DNS records. Pinkie  Another free ping sweep tool for Windows is Pinkie. Along with a straightforward ping scan, Pinkie provides a number of other capabilities such as a traceroute, port scanning and a subnet calculator.