fping: High-performance ping sweep tool

1. Tool Introduction

fping is a scriptable, high-performance variant of the standard ping utility, designed specifically to test the reachability of a large number of hosts efficiently. Unlike traditional ping, which sends a request and waits for a reply before moving to the next target, fping sends ICMP Echo Requests to multiple hosts in a round-robin fashion, cycling through the target list, which allows it to test many hosts in parallel rather than sequentially. This makes it especially well-suited for scanning entire subnets or large host lists as part of network discovery, monitoring, and inventory scripts. fping is included in the Kali Linux repositories.

2. Installation

sudo apt update
sudo apt install fping -y

Verify:

fping -v

Expected output:

fping: Version 5.1

3. Syntax

fping [OPTIONS] [target ...]

4. Command-Line Options (Full Reference)

• -a — Show hosts that are alive
• -A — Show targets by address rather than DNS name
• -b <bytes> — Amount of ping data to send
• -B <n> — Set exponential backoff factor for retries
• -c <count> — Number of request packets to send per target
• -C <count> — Like -c, but with output formatted for parsing (per-target result table)
• -d — Resolve/display DNS names for target IPs
• -D — Print timestamp before each output line
• -e — Show elapsed (round-trip) time on ping replies
• -f <file> — Read target list from a file (- for stdin)
• -g <start> <end> — Generate a target list from an IP range
• -g <IP/CIDR> — Generate a target list from a CIDR block
• -H <n> — Set IP TTL value
• -i <interval> — Interval (ms) between sending packets to different targets
• -I <interface> — Bind to a specific interface
• -l — Loop sending pings indefinitely to each target
• -m — Send probes to all addresses of a multi-homed host
• -M — Set “don’t fragment” flag
• -n — Same as -d (resolve names) in some builds
• -N — Output in “name” format for -C reports
• -O <tos> — Set the Type of Service byte
• -p <time> — Interval (ms) between ping packets to the same target in loop mode
• -q — Quiet mode, don’t show per-probe results
• -Q <interval> — Quiet mode but print periodic summary every N seconds
• -r <retries> — Number of retries for a target (default 3)
• -R — Random data size for pings
• -s — Print cumulative statistics at the end
• -S <addr> — Set source address
• -t <timeout> — Initial per-target timeout in milliseconds
• -T <timeout> — Total run-time timeout
• -u — Show targets that are unreachable
• -v — Show version
• -4 — Force IPv4
• -6 — Force IPv6

5. Basic Usage

fping -a -g 192.168.1.0/24

Expected output:

192.168.1.1 is alive
192.168.1.10 is alive
192.168.1.15 is alive

6. Practical Examples

Example 1 — Ping sweep a CIDR range, only show alive hosts

fping -a -g 10.10.10.0/24 2>/dev/null

10.10.10.1 is alive
10.10.10.5 is alive

Example 2 — Ping sweep an explicit IP range

fping -a -g 192.168.1.1 192.168.1.50 2>/dev/null

192.168.1.1 is alive
192.168.1.10 is alive

Example 3 — Read targets from a file

fping -a -f hosts.txt

10.10.10.5 is alive
10.10.10.9 is alive

Example 4 — Show elapsed round-trip time

fping -e -c 3 192.168.1.10

192.168.1.10 : [0], 84 bytes, 0.51 ms (0.51 avg, 0% loss)
192.168.1.10 : [1], 84 bytes, 0.49 ms (0.50 avg, 0% loss)
192.168.1.10 : [2], 84 bytes, 0.53 ms (0.51 avg, 0% loss)

Example 5 — Show only unreachable hosts

fping -u -g 192.168.1.0/24 2>/dev/null

192.168.1.99 is unreachable
192.168.1.200 is unreachable

Example 6 — Quiet mode with periodic summary

fping -q -Q 5 -g 192.168.1.0/24

[5.0]     256 targets, 240 alive, 16 unreachable, 100% packets alive

Example 7 — Print cumulative statistics table

fping -s -c 3 -g 10.10.10.0/28

10.10.10.1 : xmt/rcv/%loss = 3/3/0%, min/avg/max = 0.42/0.45/0.51
     Sent:16   Rcvd:14   Loss: 12%

Example 8 — Formatted parsable per-target report

fping -C 3 -q 192.168.1.1 192.168.1.10

192.168.1.1  : 0.51 0.49 0.53
192.168.1.10 : 0.61 0.58 0.60

Example 9 — Set custom timeout and retries for a lossy network

fping -t 500 -r 5 -a -g 192.168.1.0/24

192.168.1.1 is alive
192.168.1.15 is alive

Example 10 — Timestamped continuous loop mode (stopped with Ctrl+C)

fping -D -l 192.168.1.10

[1752912345] 192.168.1.10 : [0], 84 bytes, 0.51 ms
[1752912346] 192.168.1.10 : [1], 84 bytes, 0.49 ms

7. Common Use Cases

• Rapid host-alive sweeps across an entire subnet as the first step of network discovery, faster than looping standard ping in a shell script.
• Continuous or periodic network monitoring of a fixed host list (loop mode with -l and -Q).
• Feeding a clean list of live hosts into subsequent tools such as Nmap, Masscan, or RustScan.
• Large-scale infrastructure health checks in operations/monitoring scripts.

8. Automation with Bash

#!/bin/bash
# fping_sweep.sh - fast subnet sweep feeding into Nmap
SUBNET="192.168.1.0/24"
ALIVE="alive_hosts.txt"

echo "[*] Running fping sweep on $SUBNET..."
fping -a -g "$SUBNET" 2>/dev/null > "$ALIVE"

echo "[*] Found $(wc -l < "$ALIVE") live hosts. Starting Nmap follow-up..."
while read -r host; do
    nmap -sC -sV "$host" -oN "nmap_${host}.txt"
done < "$ALIVE"

9. Tips and Best Practices

• Redirect stderr (2>/dev/null) when using -a/-g on large ranges, since unreachable-host messages are printed to stderr by default and can clutter output.
• Use -C for machine-parsable output when integrating fping into other scripts or spreadsheets.
• Raise -r (retries) and -t (timeout) on unreliable or high-latency WAN links to reduce false negatives.
• Prefer fping over shell-scripted loops of ping for any sweep larger than a handful of hosts — it is dramatically faster because it doesn’t block waiting for each individual reply.
• Use -l with -Q for lightweight, ongoing availability monitoring of critical hosts.

10. Troubleshooting

• “fping: command not found”: install with sudo apt install fping.
• Permission denied / operation not permitted: some Linux configurations require elevated capabilities for raw ICMP sockets; try running with sudo or check the cap_net_raw capability on the fping binary (getcap $(which fping)).
• All hosts reported unreachable despite being alive: verify local firewall rules (iptables/nftables) aren’t blocking outbound ICMP, and check -I interface binding.
• Sweep is slower than expected on a large range: lower -i interval or reduce -r retries and -t timeout for hosts expected to be mostly reachable.

11. References

• Official site: https://fping.org/
• GitHub repository: https://github.com/schweikert/fping
• Kali Linux tool page: https://www.kali.org/tools/fping/
• Man page: man fping (installed locally)