ping 广播地址实现 ip范围

要想直到一个网段内的主机有哪些，可以使用的办法是ping这个网段的广播地址（受限制广播、网段广播、子网广播、所有子网广播）。

 

比如：ping 172.16.23.255

回复：

PING 172.16.23.255 (172.16.23.255): 56 data bytes
64 bytes from 172.16.23.85: icmp_seq=0 ttl=64 time=0.075 ms
64 bytes from 172.16.23.50: icmp_seq=0 ttl=64 time=1.552 ms (DUP!)
64 bytes from 172.16.23.98: icmp_seq=0 ttl=64 time=2.391 ms (DUP!)
64 bytes from 172.16.23.169: icmp_seq=0 ttl=64 time=2.394 ms (DUP!)
64 bytes from 172.16.23.51: icmp_seq=0 ttl=64 time=53.228 ms (DUP!)
64 bytes from 172.16.23.59: icmp_seq=0 ttl=64 time=53.237 ms (DUP!)
64 bytes from 172.16.23.191: icmp_seq=0 ttl=64 time=105.978 ms (DUP!)
64 bytes from 172.16.23.162: icmp_seq=0 ttl=64 time=108.787 ms (DUP!)
64 bytes from 172.16.23.85: icmp_seq=1 ttl=64 time=0.085 ms
64 bytes from 172.16.23.50: icmp_seq=1 ttl=64 time=1.117 ms (DUP!)
64 bytes from 172.16.23.98: icmp_seq=1 ttl=64 time=1.124 ms (DUP!)
64 bytes from 172.16.23.169: icmp_seq=1 ttl=64 time=1.127 ms (DUP!)
64 bytes from 172.16.23.51: icmp_seq=1 ttl=64 time=67.212 ms (DUP!)
64 bytes from 172.16.23.59: icmp_seq=1 ttl=64 time=67.221 ms (DUP!)
64 bytes from 172.16.23.191: icmp_seq=1 ttl=64 time=154.181 ms (DUP!)
64 bytes from 172.16.23.162: icmp_seq=1 ttl=64 time=155.601 ms (DUP!)
64 bytes from 172.16.23.85: icmp_seq=2 ttl=64 time=0.083 ms
64 bytes from 172.16.23.50: icmp_seq=2 ttl=64 time=1.032 ms (DUP!)
64 bytes from 172.16.23.98: icmp_seq=2 ttl=64 time=1.039 ms (DUP!)

 

过程基本如下：
1.我发出ping 192.168.0..255的请求，在icmp包出去之前，发出去一个多播的帧，目标mac是多播mac；

2.我收到的包是（icmp reauest），linux支持，会对其响应（icmp response），回个arp查询，查询我的arp是什么，于是我响应这个查询，这样我也学到了它的arp；

3.以后每一个ping广播的icmp，都由组内可以响应的主机来回应我，所有组内存活的主机都会响应我的ping