What's the easiest way to get a list of windows desktops that are on a subnet but do not have names listed in the dns server?
5 Answers
You could use nmap
nmap 192.168.1.0/24
would give you a listing of all the IPs being used on the subnet, along with their open ports.
-
This is perfect because the windows boxes are not going to have port 23 open but the unix boxes will– salMay 1, 2009 at 16:55
-
Why would unix boxes have port 23 open today? Sounds like a "mal"configuration to me ;) May 1, 2009 at 18:06
-
If you don't want need the port scan info,
-sP
will just check if the host is up. You might want to specify which DNS server with--dns-servers
. If a machine is offline but has a DNS entry,-R
might be useful. My suggestion for a fast scan is: nmap 192.168.0.1/24 -sL -R | grep -v "(.*)" There are better ways to grep the output, but this does the job quite well.-sL
doesn't even check that the machine is up, just sends the DNS queries,-R
make sure the DNS queries are sent. Thee grep outputs only those lines without prens, those without dns entries, remove-v
to get those with.– alifMay 1, 2009 at 20:08 -
The nmap tool will do both. However, get permission in writing to run it before you do so. Most organizations would classify it a security tool (it is) and most have explicit policies about getting permission before executing such tools.
The following is my follow up to the selected answer.
If you don't need the port scan info, -sP
will just check if the host is up. You might want to specify which DNS server with --dns-servers
. If a machine is offline but has a DNS entry, -R
might be useful. My suggestion for a fast scan is:
nmap 192.168.0.1/24 -sL -R | grep -v '(.*)' | awk '{print $2}'
There are better ways to grep the output, but this does the job quite well. -sL
doesn't even check that the machine is up, it just runs through the list of IPs, -R
sends DNS queries for all IPs, not just ones that are up - nmap won't know which are up and does not do DNS queries on down hosts by default. The grep outputs only those lines without prens -- those without DNS entries; remove -v
to get only those with DNS entries, but you'll have to change the the grep/awk to parse the IPs it that case.
Output example:
$ nmap 192.168.0.1/24 -sL -R | grep -v '(.*)' | awk '{print $2}'
192.168.0.0
192.168.0.1
192.168.0.2
192.168.0.3
# ...
Those are the IPs that have no DNS entries.
-
This is very cool. I managed to come up with something less elegant using grep and cut– salMay 1, 2009 at 20:41
- get a list of your Windows desktops and their names
- for each one, ask the DNS server if they're listed...
If you can't do (1), you've got bigger problems...