Figure out live hosts on a network

I'm trying to figure out the best way to find all live hosts on a Class C network.

1. What is the best way to figure out all the subnets that are being used?

2. Assuming that ICMP is allowed, would using something like Hping be more efficient, or NMap?

Try superscan this is my fave or if you have access to the server you should know what IP addys are allocated where

Why not try a simple ping freeware utility such as Grims Ping. I found this at Webattack, you can try searching that site for something that meets your requirements.

Cheers:

Cool tool, I'll check it out. Guess, I should explain myself a little better. I'm trying to create my own "auto" audit CD for teaching myself more. I kinda know what I wanna do, but still need to figure out how to do things.

The first thing I wanted to do was to make a bootable cd (done)
Second thing I wanted was to make the cd scan to see what live IP's are out there and put into a text file (currently working on).

Command line tools are best, since it will need to be scriptable. Thats why I wanna figure out the best way to find all live subnets first. (kinda funny to have it scan the entire class C, if I only have 3 or 4 boxes on my test network).

Hope this gives a little more insight into my thinking.

thanks again
rt

Unless you have setup your switches to block it, you could probably get them by pinging the network or broadcast address...

/nebulus

Finding out hosts, subnets, and IP Ranges? May I suggest the host command?

I wrote a tutorial about it here: http://antionline.com/showthread.php?s=&threadid=251763

I also bumped it up for you.

Not sure if this is exactly what you're looking for, but I hope it'll help.

Galen-

GREAT tutorial, very useful for footprinting.

I'm looking for a more automated way to footprint (ie. find out if IP addresses are live, then scan each of the addresses).

any other suggestions?

thanks
rt

Nebulus-

I had thought of that, something like pinging all the xxx.xxx.xxx.255 addresses. However, how would you do that. Lets say I pinged a 192.168.0.255 address. Would that broadcast it to the entire 192.168.0.xxx address and return the response to my IP address?

Quote:

---

Originally posted here by randytester
Nebulus-

I had thought of that, something like pinging all the xxx.xxx.xxx.255 addresses. However, how would you do that. Lets say I pinged a 192.168.0.255 address. Would that broadcast it to the entire 192.168.0.xxx address and return the response to my IP address?

---

Depends a little on your setup, but yes. .255 means every computer on the network (C level)...technically so does .0 ...

/nebulus

Okay,

I tested on my network:

I pinged my 192.168.0.1 address, got a response
I pinged my 192.168.0.2 address, got a response
I pinged my 192.168.0.255 address, got the request timed out msg.

This is all on the same hub, and both on the 255.255.255.0 subnet

what am i missing?

I'd have to say that the easiest way is most likely nmap -sP.

If you are using the 192.168.0.0 Network with a 255.255.255.0 subnet mask then you'd just have to type in nmap -sP 192.168.0.0/24 (then to write to a file you simple need to append > file.name to the end)

Your other option would be (assuming this is linux) to create a lil script to do it

Code:

---


#!/bin/bash
i=0
rm -rf results.txt
while [ $i -le 255 ]; do
    ping -b -c 1 192.168.0.$1
    i=`expr $i + 1`
done

---

if you want to use ping here ya go

pinger.bat
-----------------------
for /L %%X in (1,1,254) do ping -n 1 %1.%%X |find /I "reply" >>c:\reply.txt
for /F "tokens=3" %%Y in (c:\reply.txt) do fscan %%Y >c:\scanned.txt
notepad c:\scanned.txt
del reply.txt
-----------------------

you could use this on any class network by entering the first three octets without the third "."

pinger 192.168.1
pinger 10.0.0
pinger 67.88.22

but a scanner like superscan can ping them all and scan all the ports you want only on machines that return a response much faster than a bat can. you can then save the scan to a file by pushing a button

Yeah Superscan is really cool, But I'm trying to build the "Lazy Mans Pen/audit CD" for myself!!!

I think the answer would to do an nmap scan via a script, but I'm trying to get the logic down to determine how it can figure out what IP's are live.

Thinking something like

nmap -sP 192.168.0.0/24 > IP.txt

as HTRegz suggested, however that will only find me the live hosts within the 255.255.255.0 network. If there was some way to ping the subnet mask to determine if it had any live hosts, and if not skip it, that would be exactly what I'm looking for.

Something like: (sorry I don't know any programming)
Ping the subnet,
If no Live hosts next subnet
If live hosts are present nmap -sP IP ADDRESS > textfile.txt

Is something like that possible?

Something like that would indeed be very possible, either through batch-file programming or through shell scripting.

Batch file creation: http://antionline.com/showthread.php?s=&threadid=252001
Shell programming: http://antionline.com/showthread.php?s=&threadid=252818 (Not as tutorialish, but it should still prove helpful.)

change "fscan" to nmap w/ the args you want and call pinger.bat with start.bat:

start.bat
-----------------
for /L %%W in (0,1,255) do pinger 192.168.%%W
-----------------