Is there a way to get all reachable IP addresses within a private network. I know that we can get all active devices' IP addresses within same subnet using arp. I was wondering if something similar exists for entire private network
There's no really reliable way.
Generally, you'd need a request-response type protocol that is implemented (or mandatory) on all hosts. While ARP is a protocol that must work for IPv4 to function, there's nothing mandatory for IPv4 itself. ARP isn't routable, and for routed subnets you need something routable.
- ICMP echo (
ping) is often suppressed by the host firewall, or ICMP generally in a network (bad idea but common)
- relying on ICMP Destination unreachable messages from the connecting router/gateway (due to failing ARP) may not work when those messages are rate-limited or suppressed completely, obstructing rapid sweeps