I want to wake up and see the devices connected on my local network, using NMAP.

So I execute this command :

sudo nmap -sn -PU[7] -PE

(extract from the man page :

  • sn: Ping Scan - disable port scan
  • PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports
  • PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes)

So, NMAP finds perfectly devices. But lets say device A is found, if I disconnect A from the network (airplane mode), and execute the exact same NMAP command : NMAP will continue to find A. If I keep executing the command, A will be found as online ("Host is up (0.0047s latency).") during some time, and after 2/3 minutes it will not be found anymore by NMAP. And what is really strange is that I have information about latency overtime even when I have manually disconnected A.

It appears that there is somewhere a timeout, maybe the arp-timeout ? And one thing I dont understand, even if there is a timeout why does NMAP gives me a latency when A is physically disconnected ?

Thank you.

  • 1
    I suspect you aren't scanning the device you think you are. – Ryan Foley Aug 25 '15 at 1:05
  • I am pretty sure I am. The fact that the device is removed after 1/2 minutes proves it. – phenetas Aug 25 '15 at 1:54
  • Have you ever found a reason for this behavior? – Vladimir Feb 11 '18 at 18:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.