Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to determine the IP addresses of systems within a network using a bash script? And how?

share|improve this question
Do you want to run a script to discover the active IP addresses in a network? Or to discover the IP of the current system? – Eric Carvalho Jun 18 '13 at 11:58
I want to run the script to determine the active IP address of all the systems. – Tarun Jun 18 '13 at 12:01
Why bash? Is this for convenience, or is there a more specific requirement? – belacqua Jun 18 '13 at 16:41
Similar question on Stack Overflow:… – offby1 Jun 18 '13 at 17:24
I need to incorparate that feature with another script. – Tarun Jun 19 '13 at 5:21
up vote 5 down vote accepted

Install arp-scan (sudo apt-get install arp-scan) and add the following line to the script:

IPs=$(sudo arp-scan --localnet --numeric --quiet --ignoredups | grep -E '([a-f0-9]{2}:){5}[a-f0-9]{2}' | awk '{print $1}')

Now you have all the active IP addresses in the IPs variable.

Note: this will only work on a directly connected network, i.e. not accessed through a router.

PS: If you install gawk the command can be shortened to (thanks belacqua):

IPs=$(sudo arp-scan --localnet --quiet --ignoredups | gawk '/([a-f0-9]{2}:){5}[a-f0-9]{2}/ {print $1}')
share|improve this answer
Thanks Eric will give it a try. – Tarun Jun 18 '13 at 14:16
You don't need grep at all, just | awk '/([a-f0-9]{2}:){5}[a-f0-9]{2}/ {print $1}') . However, I think the straight arp-scan output is nicer. – belacqua Jun 18 '13 at 16:49
@belacqua Thanks, but I used grep because I couldn't get it working using only awk. If I use those curly braces to indicate a repetition awk outputs nothing. Do you know how to make that regex work in awk? – Eric Carvalho Jun 18 '13 at 17:10
Hmm -- this worked for me: sudo arp-scan --localnet --quiet --ignoredups | awk '/([a-f0-9]{2}:){5}[a-f0-9]{2}/ {print $1}' . and IPs=$(sudo arp-scan --localnet --quiet --ignoredups | awk '/([a-f0-9]{2}:){5}[a-f0-9]{2}/ {print $1}') – belacqua Jun 18 '13 at 18:27
@belacqua No, doesn't work for me. Tested on 12.04 and 13.04 with same results, no output. Even weirder, if I use '/[a-f0-9]:[a-f0-9]/ {print $1}' it works, but with '/[a-f0-9]:[a-f0-9]:[a-f0-9]/ {print $1}' it doesn't. – Eric Carvalho Jun 18 '13 at 18:47

This answer uses the nmap command to gather information of active hosts in the network.

Nmap ("Network Mapper") is an open source tool for network exploration and security auditing. It was designed to rapidly scan large networks, although it works fine against single hosts. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics.

Assuming you need to scan the 192.168.0.X range, you can try:

nmap -v -sP

Where is the network address and /24 is the network mask equivalent to Thus the above command will scan 256 hosts.

To collect the active IP addresses, one can use the following line:

IPS_UP=$(nmap -nsP 2>/dev/null -oG - | grep "Up$" | awk '{printf "%s ", $2}')

It actually concatenates the list of active IP addresses (filtered by grep) into a variable called IPS_UP:

  • nmap is run with switches -n (no name resolution), -sP (ping scan) and -oG to output a grep processable output onto the standard output (-).
  • grep filters only lines containing the word "Up" at the end of line ("$").
  • awk prints the second column in the list output by nmap, which is the IP address, and appends a space.
  • The $() command substitution allows the output of the chain of commands to be assigned to the IPS_UP variable.

The Network Mapper can be installed by using sudo apt-get install nmap.

nmap might discover more hosts if run by a privileged user. This is because different kind of packets are sent to scan a host. By modifying the above line to read sudo nmap ... allows to run the nmap command as root.

share|improve this answer
+1 for not reinventing the wheel – belacqua Jun 18 '13 at 16:41

Obviously this is a bad idea, but I gave it a try


IP=$(ifconfig eth0 | grep Mask | cut -d ':' -f2 | cut -d " " -f1)
Mask=$(ifconfig eth0 | grep Mask | cut -d ':' -f4 | cut -d " " -f1)
Max=$(( 255 * 255 * 255 * 255 ))
for key in "${!IPArray[@]}";
   NetArray[$key]=$(( ${IPArray[$key]} & ${MaskArray[$key]} ))
   Start=$(( $Start + (${NetArray[$key]} << (3-$key)*8) )) 
echo "Your IP Address   : $IP"
echo "Your N/W Mask     : $Mask"
echo "Your N/W Address  : ${NetArray[@]}"
echo "IPs to be Checked : $(( $Max - $Start ))"
for ((IPs=$Start; IPs <= $Max; IPs++))
   IP=$(( IPs >> 24 ))
   IP="$IP.$(( (IPs >> 16) & 255 ))"
   IP="$IP.$(( (IPs >> 8) & 255 ))"
   IP="$IP.$(( IPs & 255 ))"
   $(ping -c 1 -w 1 $IP >& /dev/null)
   if [[ $? -eq 0 ]]; then
      echo "$IP exists in Network. Just $(( $Max - $IPs )) more to go."
share|improve this answer
This will not detect firewalled hosts. – Eric Carvalho Jun 18 '13 at 16:09
Yup. Reading about arp-scan :) – thefourtheye Jun 19 '13 at 0:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.