First I try running nmap -sn ip/24 to check live hosts on a subnet. It returns that all 255 hosts are live which I know is not true. I do fping -g ip/24 and get that 7 hosts are up which makes more sense. Now I'm trying to figure out network topology using nmap -sn --traceroute ip/24 and the entire range of 0-255 is included. How can I just use the hosts that were returned by the fping command? I figure there has to be some way to pipe that argument or something to the nmap traceroute command, but I have no idea how to do this. 
how to use only certain addresses in subnet for traceroute?
pipe;ping;nmap;traceroute
you could use fping output as nmap target list:fping -aqg ip/24 | xargs nmap -sn --tracerouteIf your problem is that some gateway in your network is giving fake ARP responses (generating false positives), you can use -sn -PE to fix that:nmap -sn -PE --traceroute ip/24That way, nmap will exclusively show a host (and make a traceroute) if the host reply the ICMP request (ping).