Junior admin - how to discover/map the network to increase understanding?

Question

I am a junior admin and have been tasked with gaining an understanding of the network. I know and use some of the servers on the network, so am able to tracert/ping them to see the names/addresses of equipment there are along the way, and gradually build a map, but how do I put the feelers out to find out what's out there if I don't know the names of server etc?

Answer 1

Any time I want to map an unfamiliar network, I start with what the routing protocols can tell me. And usually the routing protocols can tell me pretty much everything. After all, the routing protocols have to know what the network looks like—and it's almost never exactly the way it's documented (if it's documented at all).

For an example of how this would go and to make things easy, let's say we're running OSPF. The great thing about OSPF (and link-state protocols generally) is that every router has already figured out the topology of the network. You just have to ask one of them:

> show ospf database router            

    OSPF link state database, area 0.0.0.0
 Type       ID               Adv Rtr           Seq      Age  Opt  Cksum  Len 
Router  *192.168.0.1      192.168.0.1      0x80000005  1083  0x2  0x532c  96
Router   192.168.2.1      192.168.2.1      0x80000003  1124  0x2  0xe1df  84
Router   192.168.5.1      192.168.5.1      0x80000004  1129  0x2  0xcf2f 108
Router   192.168.8.1      192.168.8.1      0x80000006  1133  0x2  0x83ed  60
Router   192.168.12.1     192.168.12.1     0x80000007   126  0x2  0xc1c9  84
Router   192.168.16.1     192.168.16.1     0x80000005  1086  0x2  0x847e  72
Router   192.168.20.1     192.168.20.1     0x80000004  1094  0x2  0x54da  60
Router   192.168.24.1     192.168.24.1     0x80000005  1148  0x2  0xd42c  60
Router   192.168.28.1     192.168.28.1     0x80000006   293  0x2  0xcf9   60

There we go, we have 9 routers in our OSPF area. Draw 9 boxes in visio and label them with those IPs. Next, to figure out how they're connected, ask for more detail:

> show ospf database router detail

    OSPF link state database, area 0.0.0.0
 Type       ID               Adv Rtr           Seq      Age  Opt  Cksum  Len 
Router  *192.168.0.1      192.168.0.1      0x80000005  1398  0x2  0x532c  96
  bits 0x0, link count 5
  id 192.168.5.1, data 10.0.0.1, Type PointToPoint (1)
  TOS count 0, TOS 0 metric 1
  id 10.0.0.0, data 255.255.255.0, Type Stub (3)
  TOS count 0, TOS 0 metric 1
  id 192.168.2.1, data 10.0.1.2, Type PointToPoint (1)
  TOS count 0, TOS 0 metric 1
  id 10.0.1.0, data 255.255.255.0, Type Stub (3)
  TOS count 0, TOS 0 metric 1
  id 192.168.0.1, data 255.255.255.255, Type Stub (3)
TOS count 0, TOS 0 metric 0

Router   192.168.2.1      192.168.2.1      0x80000003  1439  0x2  0xe1df  84
...

So here we're looking at the LSA for router 192.168.0.1. It has 5 links that OSPF knows about. Two of the links id 192.168.5.1 and id 192.168.2.1 connect to other OSPF routers. Back to visio: draw a line between the 192.168.0.1 box and the 192.168.5.1 box. Draw another line between the 192.168.0.1 box and the 192.168.2.1 box.

The other 3 links are stubs, so OSPF will advertise the existence of those subnets, but there aren't any more OSPF routers on those links. You can just draw 3 clouds in visio labeled with the subnet information (plug in id and data for the network and mask for each) and draw a line from each to the 192.168.0.1 router.

Keep doing that until you have a network map.

Of course it's never quite that simple, but no matter what, your routers have already figured out what your network looks like. Transcribing your routers' databases onto a map is always an enlightening experience. You'll learn lots about routing protocols AND your network.

Answer 2

Work with the "2nd line team." Being able to effectively work as a team with your coworkers is an invaluable skill; possibly moreso than being able to perform a network and server inventory. Also, finding and reading existing documentation is a better use of your time than figuring it all out from scratch. If no documentation exists, then start writing it as you go, and figure out how to publish (and publicize) it, because that will really make you stand out.

Answer 3

I'd recommend trying http://www.secdev.org/projects/scapy/ in conjunction with nmap. Its a little tricky at first but if you do a broad enough scan you should be able to pick everything up.