Printable View
How do you determine a system is alive or dead in a network?
I tried ping, telnet, ftp and telneting to different ports, snmp ping. I also tried Nmap but it dose not work when firewall is installed (ex. XP with sp2).
Is there any other tools or methods through which I can determine the system status.
I can sniff as it is in network to determine the position, suppose if the system is outside network?
It will be very helpful.... Please let me know
You mentioned nmap... Have you tried something like 'nmap -sF -P0 -p 1-65550 -vvv -O <ip-address>' ?
There are lots of little ways to discover machines on a network, most of which require a good deal of patience if there are no active ports open, etc..
Have a look at things like DHCP Pings, ARP Requests, UDP Pings, etc. And set up a sniffer on the same network segment as the host (snoop, tcpdump, ethereal, etc.).
-- spurious
[Edit]
Hint: What do you think traffic to and from this host (initiated/established) would look like to a third party? Even with no ports open you can tell a lot about a machine by the kinds of traffic you 'hear' associated with it. Even better if you can get some ARP requests ("ARP --> Who has 08:20:FG:26:03 Tell 192.168.22.7 <--- 192.168.22.3 has 08:20:FG:26:03..." )
How about some more info such as if its a remote host and are you on the same subnet? You can sniff traffic till you get a packet from said host. But more info is needed to fully answer your question
Like Darksnake said, sniff the line and wait for the machine to broadcast. This can be SMB, ARP, etc. XP's firewall won't allow you to filter outbound... so you are bound to see something from that host within a couple of minutes. This only works on your subnet though.
There are other methods... such as scanning. Just because the firewall is blocking doesn't mean that you can't tell its there. You will often see filtered ports from firewalled hosts. They will reject the packets instead of drop them, giving themselves away.
arp, snmp, DHCP pings works fine. I can sniff and analyse the traffic to determine the OS and system status, but if the system is in my network?
The system I am talking is not in my network? and nmap -sF -P0 -p 1-65550 -vvv -O <ip-address> dose not work when firewall is running in the opposite machine. I tried udp too... but no results.
I am not able to scan the machine, so there is no way I can look at the open ports?
Please help me out....
spurious_inode , This is the reply I am getting when i try nmap as you adviced.
C:\nmap>nmap nmap -sF -P0 -p 1-65535 -vvv -O <target>
Starting nmap 3.75 ( http://www.insecure.org/nmap ) at 2004-11-24 06:53 India St
andard Time
Failed to resolve given hostname/IP: nmap. Note that you can't use '/mask' AND
'[1-4,7,100-]' style IP ranges
Initiating FIN Scan against <target> [65535 ports] at 06:53
FIN Scan Timing: About 0.31% done; ETC: 10:35 (3:41:11 remaining)
It dose not end....
C:\nmap>nmap nmap -sF -P0 -p 1-65535 -vvv -O <target>
You have to change <target> to the hostname or ip that you want to scan...
yes I tried changing the target and almost all types of scan possible with nmap, its not working ...... against win xp sp2
please let me know if there is some way out....
Apparently nmap thinks you want to scan a host named "nmap".Quote:
C:\nmap>nmap nmap -sF -P0 -p 1-65535 -vvv -O <target>
Starting nmap 3.75 ( http://www.insecure.org/nmap ) at 2004-11-24 06:53 India Standard Time
Failed to resolve given hostname/IP: nmap
Try:
nmap -sF -P0 -p 1-65535 -vvv -O <target>
Peace always,
<jdenny>
its like that beacuase i had pasted it (nmap appears only once). That was a mistake bacause of copy paste...
Thank you all
its working finally. With Nmap 3.75 I am able to trace.
nmap -n -vv -P0 -O <target>