Discover LAN's IP range, netmask & gateway?

Question

If I am plugged into a network with no DHCP and no reachable 'sample' hosts where I can peek in the configs. how do I discover/guess the network IPs range, netmask? Gateway IP address?

P.S. Don't suggest bruteforcing 192.168.*.* with various popular netmasks :))

Answer 1

If you were to run a packet sniffing program like wireshark or tcpdump you will likely see ARP brodcast requests that would be something like:

"Who has 192.168.1.12, tell 192.168.1.10"

From these broadcast messages you can probably infer what the network is.

Answer 2

You can try using SLP (or some other discovery protocol) to discover hosts, printers, etc. on the network if you have an idea of what devices may be on the network.

Answer 3

In addition to these other very good ideas, you could listen for CDP traffic. Cisco Discovery Protocol. However, there are a couple of misconceptions you've got.

1. It's not a good practice, but a single broadcast domain can have more than one IP subnet.
2. You don't have to have a single gateway on a network. You can have many. For a given host, only one will be the default, and that's usually what can get you out to the internet, but not always. In some cases, there's no router at all - the only way you can get out is via application-level proxies.