Figure out live hosts on a network

[randytester]

I'm trying to figure out the best way to find all live hosts on a Class C network.

1. What is the best way to figure out all the subnets that are being used?

2. Assuming that ICMP is allowed, would using something like Hping be more efficient, or NMap?

[THE-OMEN]

Try superscan this is my fave or if you have access to the server you should know what IP addys are allocated where

[DjM]

Why not try a simple ping freeware utility such as Grims Ping. I found this at Webattack, you can try searching that site for something that meets your requirements.

Cheers:

[randytester]

Cool tool, I'll check it out. Guess, I should explain myself a little better. I'm trying to create my own "auto" audit CD for teaching myself more. I kinda know what I wanna do, but still need to figure out how to do things.

The first thing I wanted to do was to make a bootable cd (done)
Second thing I wanted was to make the cd scan to see what live IP's are out there and put into a text file (currently working on).

Command line tools are best, since it will need to be scriptable. Thats why I wanna figure out the best way to find all live subnets first. (kinda funny to have it scan the entire class C, if I only have 3 or 4 boxes on my test network).

Hope this gives a little more insight into my thinking.

thanks again
rt

[nebulus200]

Unless you have setup your switches to block it, you could probably get them by pinging the network or broadcast address...

/nebulus

[SonofGalen]

Finding out hosts, subnets, and IP Ranges? May I suggest the host command?

I wrote a tutorial about it here: http://antionline.com/showthread.php?s=&threadid=251763

I also bumped it up for you.

Not sure if this is exactly what you're looking for, but I hope it'll help.

[randytester]

Galen-

GREAT tutorial, very useful for footprinting.

I'm looking for a more automated way to footprint (ie. find out if IP addresses are live, then scan each of the addresses).

any other suggestions?

thanks
rt

[randytester]

Nebulus-

I had thought of that, something like pinging all the xxx.xxx.xxx.255 addresses. However, how would you do that. Lets say I pinged a 192.168.0.255 address. Would that broadcast it to the entire 192.168.0.xxx address and return the response to my IP address?

[nebulus200]

Originally posted here by randytester
Nebulus-

I had thought of that, something like pinging all the xxx.xxx.xxx.255 addresses. However, how would you do that. Lets say I pinged a 192.168.0.255 address. Would that broadcast it to the entire 192.168.0.xxx address and return the response to my IP address?

Depends a little on your setup, but yes. .255 means every computer on the network (C level)...technically so does .0 ...

/nebulus

[randytester]

Okay,

I tested on my network:

I pinged my 192.168.0.1 address, got a response
I pinged my 192.168.0.2 address, got a response
I pinged my 192.168.0.255 address, got the request timed out msg.

This is all on the same hub, and both on the 255.255.255.0 subnet

what am i missing?