Ping scans allows including trace route information of the targets. Use the Nmap option --traceroute to trace the route from the scanning machine to the target host:
#nmap -sn --traceroute google.com microsoft.com Nmap scan report for google.com (216.58.193.46) Host is up (0.16s latency). Other addresses for google.com (not scanned): 2607:f8b0:4012:805::200e rDNS record for 216.58.193.46: qro01s13-in-f14.1e100.net TRACEROUTE (using port 443/tcp) HOP RTT ADDRESS 1 1.28 ms 192.168.0.1 2 ... 3 158.85 ms 10.165.1.9 4 ... 5 6 165.50 ms 10.244.158.13 7 171.18 ms 10.162.0.254 8 175.33 ms 200.79.231.81.static.cableonline.com.mx (200.79.231.81) 9 183.16 ms 10.19.132.97 10 218.60 ms 72.14.203.70 11 223.35 ms 209.85.240.177 ...