nmap -sP 10.1.1.0/24
When I need to find an open IP, this is a decent way to do it. I wish there were a way to find IPs that don’t respond, but this works for now. This won’t work if your network bans ICMP traffic, or your host doesn’t respond, but is alive.
If you want to extract the IPs from your output, you can use this SED statement
sed -n 's/^.*[^0-9]\([0-9]*\.[0-9]*\.[0-9]*\.[0-9]*\).*$/\1/p'