As part of my preparation for the eCPPT exam, I created this simple script to iterate though various types of ping switches. The eCPPT dedicates a lot of time to remote host and firewall configuration enumeration. While one server might respond to a particular ping method, another server may not.

nmap-ping () 
{ 
    rm /tmp/ping_* > /dev/null 2>&1;

    uniquehosts="/tmp/ping_$(date +%T).txt";

    pings=("-sn -n" "-sn" "-sn --disable-arp-ping" "-sn -n --disable-arp-ping");

    function print () 
    { 
        echo -e "\n\033[1;33m$1\033[0;39m"
    };

    for ping in "${pings[@]}";
    do
        d="$(date "+%T")";
        nmap_cmd="/usr/bin/nmap $ping -oA /tmp/ping_$d ${@:1}";
        print "$nmap_cmd";
        eval "$nmap_cmd" | grep --color=always -C50 'Nmap scan report for';
        sleep 1.1;
    done;

    print "Scan statistics:";
    grep --color=always -ioP '(?<=addresses).*?(?=onds)' /tmp/ping_*.nmap;

    print "Hosts discovered:";
    grep --color=always 'Nmap scan report for' /tmp/ping_*.nmap | sort -n;

    print "Unique hosts:";
    awk '/scan report for/{print $5}' /tmp/ping_*.nmap | sort -u | tee "$uniquehosts"
}