Ping Sweep for downed hosts

dnoy · 05-22-2012, 09:07 AM

does anyone know a good tool/way to ping sweep multiple devices and report and the devices that are down? I have a txt file with numerous IPs (separated by carriage) that i need to scan. I want to know which devices are currently down.

I use nmap but it only shows the machines that are up.

Please advise

thank you,

MensaWater · 05-22-2012, 09:21 AM

You can do "ping -c 1 <hostname>" to send a single ping to a host.

You can run "echo $?" to see the return code for the ping. A return code of 0 means successful and a return code of 1 (or any greater than 0) means it was unsuccessful.

So if your list of hosts is named "list" then you could do a for loop to test each one:

Code:

for host in $(cat list)
do ping -c 1 $host >/dev/null 2>&1
   if [ $? -gt 0 ]
   then echo $host is down
   else echo $host is up
   fi
done

The redirect to /dev/null prevents the output of the ping command from showing up so you only see the output of your script.

Note that ping doesn't necessarily prove a host is "down". It might be a bad switch port, network card, network cable or other things that prevent it from being accessed. You could also put in a longer ping count with the -c to try it multiple times before reporting it "down".

chrism01 · 05-22-2012, 11:57 PM

What MensaWater said

, especially the 'Note...'.
I'd also add that if you want to do this regularly/as per monitoring, try Nagios.

MensaWater · 05-23-2012, 08:55 AM

+1 on Nagios

We use it extensively here to monitor almost everything. You can check many things other than a simple ping such as filesystem states, service/process states, DB sizes and connectivity, web pages and almost anything you can think of. You can even design checks that work in lieu of standard ping (e.g. some Windows clusters have the same IP active on both nodes at the same time which causes the ICMP ping to apppear as failing because the return code is non-zero.)

glamiss · 05-24-2012, 02:16 PM

i have a (rather) large bash script that does something similar. i have it take into account duplicate packets, damaged packets, and then yesterday i found a new one, filtered content or something...
this won't make a whole lot of sense without the rest of it, but here's an example. the MIP is the machine ip, MNAME is machine name (defined above this portion, obviously). there's error checking and stuff in the if / else parts, but i took that out of here. just defines the error type and the loss amount / type. then there are different settings for whether it's 100% loss, greater-than-acceptable (defined by a limit set in the file), ANY (greater than 0 but less than what's acceptable) and so on

Code:

        # note: no need to do a -w unless you're flooding; -c "x" will be 1/sec anyway
        echo -e "\nPinging machine $MNAME"
        LOSSLINE=`ping -c ${PING_COUNT} $MIP | grep loss`
        echo "LOSSLINE is $LOSSLINE"
        ##########
        # If there are duplicates, get the duplicates and the loss
        # report duplicates as an option, along with loss

        echo $LOSSLINE | grep duplicates
        DC="$?"
        if [ "$DC" = "0" ]
        then
                # There were duplicate packets
        else
                echo $LOSSLINE | grep errors
                ER="$?"
                if [ "$ER" = "0" ]
                then
                        # There were errors in the packets
                else
                        echo $LOSSLINE | grep damaged
                        DM="$?"
                        if [ "$DM" = "0" ]
                        then
                                # There were damaged packets
                        else
                                # No duplicates, damaged, or errors (normal operation)
                        fi
                fi
        fi

        # This line is to make sure that the value for LOSS is actually a number
        expr $LOSS / 1 > /dev/null 2>&1
        PC="$?"
        if [ "$PC" != "0" ] && [ "$PC" != "1" ]
        then
                # No matter what, everything here will mean complete
                # loss for our purposes. Just need to trap the reasons

it does this in a while loop of however many hosts are defined in the variables above this part and sends the appropriate errors, whether it's email only or (in my case) sends to an oracle dtabase to report the error. there are various exit points along the way in case it encounters errors with this, that, or the other. there are a few redundant things in here, especially the way it checks the amount of variables a few times, but i wanted to minimize the error points

Code:

set | grep -v '=$' | grep ^MACHINE > $PLIST
PCOUNT=`cat $PLIST | wc -l`

# Initialize primary loop
p=1
while [ "$p" -le "$PCOUNT" ]
do
        LINE="`cat $PLIST | head -$p | tail -1`"
        MIP="`cat $PLIST | head -$p | tail -1 | awk -F\= '{print $2}' | awk -F\, '{print $1}'`"
        check_ip
        if [ -z "$OC_ER" ]
        then
                cat $PLIST | head -$p | tail -1 >> $MLIST
        fi

        p=$[$p+1]
done

i have it creating files in its own tmp folder so that if there's a point of failure i can look at it and send it to someone if they don't believe me