Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I ask just in case of curiosity and this is just an imaginary network

Imagine an internal LAN network without any DHCP server implemented; So to access the network we should use static IP(s);

But my question is what if I don't know what are the ranges of valid IPs in this LAN network(we don't even know the IP class that is used in this network), is it possible to detect valid IP ranges or DNS server IP?

share|improve this question
up vote 1 down vote accepted

Also, in the situation where you don't have access to documentation or network equipment (or if a hostile person was trying to figure out your network), running a scan with a tool such as Wireshark will allow you to capture network traffic, including ARP requests (which will include IPs).

A good capture would give you enough info to determine the probable gateway, IP scheme, and DNS servers easily.

share|improve this answer

Sure. You check the network gear. They will have the subnets defined on them, from which you can extrapolate valid IP ranges, and they should also contain arp tables you could check to find existing devices on the network and match them with IPs.

That, of course, assumes a functional network, and devices that are actually sending and receiving network traffic.

Without access to the network gear, the best you'd probably be able to do is ping scans, and you'd have to hope that ICMP traffic isn't blocked by any of the network equipment and that the devices on the network are configured to actually respond to pings.

share|improve this answer

Well, if you have access to the machines, log in and look at the network settings. Write down:

  1. IP (not so important)
  2. Network mask (combine wiht the IP to get the network range)
  3. Default gateway
  4. DNS servers

Item 3 & 4 are probably the same on all hosts. Item 1 & 2 should yield the used subnets.

Once you have these, get nmap (optionally with a nice graphical frontend and scan the network to find all used IPs and OSses.

[Edit] This will not quite work on huge networks, but if you have a network with multiple subnets, different gateways etc then I also expect there is documentation somewhere. Either at IT, or the IT folders, or the a safe in a 'disaster recovery document.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.