Is it possible with Nmap (or other tool) to scan a range of private IPs (let's say but being outside any private network (using those IPs) ?

  • 1
    Sure you can. Connect via VPN to the location where you want to scan, and scan away. The reason for private addresses, is just that, to maintain a separate, and private network.
    – munkeyoto
    Commented Mar 28, 2016 at 19:51
  • @munkeyoto thank you, but how come, when i'm not connected to my network if i do: nmap, it only scans 512 hosts ? Commented Mar 28, 2016 at 20:04
  • Think of it this way. How do you grab something from your fridge while you're outside your house? You can't stick your hands through walls. You have to actually get up and walk into the kitchen. You cannot penetrate the "wall" that is NAT without actually having a NATed IP address.
    – Ohnana
    Commented Mar 28, 2016 at 20:43
  • 1
    Private IPs are not unique; which of the umpteen networks on the planet do you wish to scan?
    – Phil Lello
    Commented Mar 28, 2016 at 20:51
  • 1
    I thought your previous question about nmap addressed the issue of scanning only 512 IPs.
    – schroeder
    Commented Mar 28, 2016 at 22:06

1 Answer 1


Not using a VPN or some other way to be connected as if you were local, the answer is "no", but not because of a limitation in Nmap or any similar tool.

The primary reason this won't work is because the IP range you are talking about,, is considered a private internet address range per RFC1918, which is not supposed to be routed over the public Internet. In almost all cases this means it will likely be Null-Routed by all the Internet Service Providers routing traffic between your location and the potential target IPs and you will get "no route to host" warnings at best.


That said there are many situations where networks are misconfigured and some connectivity leaks out a very short distance. I've seen this on small providers of metropolitan Ethernet networks and also with misconfigured MPLS networks but these were technically local connections to where I was and not something that could have been reached over the global Internet at large.

  • 1
    So, if i'm physically close to the private network, but not connected on it i can't scan it ? Commented Mar 28, 2016 at 21:53
  • Correct, you need to be connected to it on an IP-level to be able to scan it properly otherwise you're just testing the external network connected to it and the NAT rules allowed. Note: There is an exception to this, if you work for Company A and are on Company A's public network depending on the configuration of the network there are scenarios where you could connect to Company A's private network via internal routing within the Company A network. This would not be the norm but it could happen. Again I assume your question refers to being outside of Company A completely. Commented Mar 28, 2016 at 22:15
  • thank you, last question though, can i ping a private IP if i'm not on the same network and if the machine if connected (to its network) ? Commented Mar 28, 2016 at 22:20
  • 2
    Not directly but if there is a NAT rule allowing that system to be accessed from the Internet you could ping the "External IP address" and your ping would be NAT'ed and in turn make it to the internal server if Ping is allowed in bound. If there is no NAT rule for that server then no. Commented Mar 28, 2016 at 22:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .