Ping Mapping

[SirDice]

Originally posted here by Irongeek
In linux you can use the "-b" option with the ping command to ping the network broadcast address (all ones in the host part of the address if read in binary). All boxes that accept ICMP echo requests should respond. {.....}

Ehhmmm. If your hosts respond to this broadcast ping your network is susceptible to a smurf attack.

[devildell]

thanks all, after reading that part of the book again, and reading your posts and practising on my home network, i think i have got it....

thank you very much to all of you...... however i believe that thehorse13's post was the best........

[droffohcam03]

ok im sorry but im a little bit confused. Are you saying you should do a ping sweep to see all devices on the network then use tracert to find which devises are routers?

and what was that about pining the broadcast address by default dont most computers ignore a request like 192.168.2.255?

[Irongeek]

Originally posted here by droffohcam03
ok im sorry but im a little bit confused. Are you saying you should do a ping sweep to see all devices on the network then use tracert to find which devises are routers?

and what was that about pining the broadcast address by default dont most computers ignore a request like 192.168.2.255?

The way a network broadcast address works is that all the host bits are set to 1. For example, if the subnet mask is 255.255.240.0 then in binary the octets would look like:

11111111. 11111111. 11110000.00000000

So we know the last 12 bits are the host part of the address. If we AND this subnet mask with a know IP, lets say 192.168.1.1 then we get:

11000000. 10101000.00000001.00000001
AND
11111111. 11111111. 11110000.00000000
=
11000000. 10101000.00000000.00000000

Which is just the network part. If we want the broadcast address for the network that IP 192.168.1.1/20 is on we just set all the host bits to 1:


11000000. 10101000.00001111.11111111

Which is
192.160.15.255

Don't know if that helps.