Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What's the easiest way to get a list of windows desktops that are on a subnet but do not have names listed in the dns server?

share|improve this question
add comment

5 Answers

up vote 6 down vote accepted

You could use nmap

nmap 192.168.1.0/24

would give you a listing of all the IPs being used on the subnet, along with their open ports.

share|improve this answer
    
This is perfect because the windows boxes are not going to have port 23 open but the unix boxes will –  sal May 1 '09 at 16:55
    
Why would unix boxes have port 23 open today? Sounds like a "mal"configuration to me ;) –  Oskar Duveborn May 1 '09 at 18:06
    
If you don't want need the port scan info, -sP will just check if the host is up. You might want to specify which DNS server with --dns-servers. If a machine is offline but has a DNS entry, -R might be useful. My suggestion for a fast scan is: nmap 192.168.0.1/24 -sL -R | grep -v "(.*)" There are better ways to grep the output, but this does the job quite well. -sL doesn't even check that the machine is up, just sends the DNS queries, -R make sure the DNS queries are sent. Thee grep outputs only those lines without prens, those without dns entries, remove -v to get those with. –  alif May 1 '09 at 20:08
    
doh! confused telnet and ssh port numbers. –  sal May 1 '09 at 20:37
add comment

The nmap tool will do both. However, get permission in writing to run it before you do so. Most organizations would classify it a security tool (it is) and most have explicit policies about getting permission before executing such tools.

share|improve this answer
add comment

The following is my follow up to the selected answer.

If you don't need the port scan info, -sP will just check if the host is up. You might want to specify which DNS server with --dns-servers. If a machine is offline but has a DNS entry, -R might be useful. My suggestion for a fast scan is:

nmap 192.168.0.1/24 -sL -R | grep -v '(.*)' | awk '{print $2}'

There are better ways to grep the output, but this does the job quite well. -sL doesn't even check that the machine is up, it just runs through the list of IPs, -R sends DNS queries for all IPs, not just ones that are up - nmap won't know which are up and does not do DNS queries on down hosts by default. The grep outputs only those lines without prens -- those without DNS entries; remove -v to get only those with DNS entries, but you'll have to change the the grep/awk to parse the IPs it that case.

Output example:

$ nmap 192.168.0.1/24 -sL -R | grep -v '(.*)' | awk '{print $2}'
192.168.0.0
192.168.0.1
192.168.0.2
192.168.0.3
# ...

Those are the IPs that have no DNS entries.

share|improve this answer
    
This is very cool. I managed to come up with something less elegant using grep and cut –  sal May 1 '09 at 20:41
add comment
  1. get a list of your Windows desktops and their names
  2. for each one, ask the DNS server if they're listed...

If you can't do (1), you've got bigger problems...

share|improve this answer
add comment

Advanced ip scanner might help.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.