I want to wake up and see the devices connected on my local network, using NMAP.

So I execute this command :

sudo nmap -sn -PU[7] -PE

(extract from the man page :

  • sn: Ping Scan - disable port scan
  • PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports
  • PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes)

So, NMAP finds perfectly devices. But lets say device A is found, if I disconnect A from the network (airplane mode), and execute the exact same NMAP command : NMAP will continue to find A. If I keep executing the command, A will be found as online ("Host is up (0.0047s latency).") during some time, and after 2/3 minutes it will not be found anymore by NMAP. And what is really strange is that I have information about latency overtime even when I have manually disconnected A.

It appears that there is somewhere a timeout, maybe the arp-timeout ? And one thing I dont understand, even if there is a timeout why does NMAP gives me a latency when A is physically disconnected ?

Thank you.

  • 1
    I suspect you aren't scanning the device you think you are.
    – Ryan Foley
    Aug 25, 2015 at 1:05
  • I am pretty sure I am. The fact that the device is removed after 1/2 minutes proves it.
    – phenetas
    Aug 25, 2015 at 1:54
  • Have you ever found a reason for this behavior?
    – Vladimir
    Feb 11, 2018 at 18:10
  • Hm, the same experience here today. For one particular IP address was nmap -sP scan telling 'Host is alive'. Does not matter if the network cable was in or out :( Any idea what's going wrong? Thanks. Oct 5, 2022 at 9:16


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.