Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I want to scan for powered on computers on my LAN and gather logs about that. I tried nmap but it didn't work very well (a lot of switched on computers are not getting detected).

nmap -sP 192.168.2.0/24
Nmap done: 256 IP addresses (10 hosts up) scanned in 6.07 seconds

I also thought about looking at network TCP packets for IPs, but I don't know of any tool ready to do that.

On this network, all computers have static IPs associated, so a IP identifies a computer. The PCs have different operating systems (Windows 7, Ubuntu 10.04, Ubuntu 12.04 and more).

What's my best chance?

share|improve this question

7 Answers 7

Have you tried other scan options from nmap? The ping option may not always work, but other scan options may be more reliable? Try,

nmap -PS 192.168.2.0/24 (TCP SYN ping)

or

nmap -PR 192.168.2.0/24 (ARP scan)

share|improve this answer
1  
ARP scan will work best on LAN, a machine must respond to ARP query always, no matter the firewall configuration. Windows by default blocks ICMP Echo so nmap -sP won't detect them –  Hubert Kario Jan 18 '13 at 10:17
    
-PS reports 16 hosts up, while -PR reports 14. There are, at least, 60 hosts up right now :( –  Jorge Suárez de Lis Jan 18 '13 at 10:30
    
@JorgeSuárezdeLis are you scanning from a machine in the same subnet/VLAN? Are you performing the scan as root? –  Hubert Kario Jan 18 '13 at 10:32
    
Both answers: yes –  Jorge Suárez de Lis Jan 18 '13 at 11:39
    
For a privileged (root) scan on a local subnet, Nmap defaults to using ARP scan. You can get the default host discovery (ICMP Echo, TCP 80 SYN, TCP 443 ACK, ICMP Timestamp) by using --send-ip or --unprivileged –  bonsaiviking Jan 18 '13 at 12:58

Try Look@LAN to scan for powered on computers.

There are alternatives to Look@LAN and some of them are even free or free and open source.
Personally I can recommend the Angry IP Scanner which is OpenSource and multiplatform or Advanced IP Scanner which is made for Windows platforms and not OpenSource but free.

share|improve this answer
    
I'd prefer FOSS software whenever possible. Thank you anyways! –  Jorge Suárez de Lis Jan 18 '13 at 16:25
    
I've added some alternatives –  wullxz Jan 18 '13 at 18:47
    
Thanks, Angry IP Scanner is a nice application, but only for interactive usage. I want to gather some logs automatically, and a cli application is better. I've already resolved this issue with nmap anyway. –  Jorge Suárez de Lis Jan 20 '13 at 2:59
    
ok, no problem. Please don't forget to mark your answer as valid answer then. ;) –  wullxz Jan 21 '13 at 22:12
    
Kinda unrelated, but do you know how to format the "IP List file" when using Angry IP Scanner? I can't find doco on it anywhere. –  Vasili Syrakis Feb 5 at 0:41

ping -b the broadcast IP then arp -a

share|improve this answer
1  
afaik, only linux clients will respond to a broadcast (if not explicitly blocked). Windows clients don't. –  wullxz Jan 18 '13 at 9:58
    
arp -a on a router should have all the machines though. If one does have a domain controller, running arp -a on it should give similar results –  Hubert Kario Jan 18 '13 at 10:21
1  
Some of the target machines aren't windows, so the Domain Controller option is probably not that useful. –  EightBitTony Jan 18 '13 at 10:24
    
FWIW, I just tried ping -b followed by arp -a and the results were missing two machines I know to be switched on. –  John Gardeniers Jan 18 '13 at 12:28
    
I tried it myself and I got all the machines (even the windows machine and a windows vm whose not showed with ping -b BroadcastIP –  Hicham LEMGHARI Jan 18 '13 at 12:30
up vote 1 down vote accepted

It seems that the problem was the probing rate (too much packets per second?). Using the parameter --max-rate made it performance much better. It takes ages to run, but at least it works.

$ nmap -sP --max-rate 1  192.168.2.0/24
...
Nmap done: 242 IP addresses (67 hosts up) scanned in 434.04 seconds
share|improve this answer

ARP scan (-PR) is the default in a LAN. Besides, you can also use advanced ping options such as nmap -PS21-23,80,135,139,443,445 target

Or scan the 1000 most common ports (or even all ports -p-) without ping nmap -Pn -p- target which is somewhat slower.

share|improve this answer

arpwatch can come very handy for getting a first impression on what is going on; the be-all-end-all tool to see details would be wireshark (even better in conjunction with a switch that has a monitoring port configured or a similar network tap). BTW, since you appear to be new to such techniques: using such tools in a professional setting is acceptable in two situations: a) you are a developer and analysing ONLY the traffic concerning your application under test, b) you are among the people responsible for the network/infrastructure/servers and/or have have been asked or allowed to do so by these people. Anything else will usually be considered suspicious or hostile activity by the same people and might lead to having some explaining to do.

share|improve this answer

I think the best would be to use a monitoring system - nagios, zabbix .. etc

share|improve this answer
6  
A monitoring system will only care about computers it has previously been configured to monitor. –  rackandboneman Jan 18 '13 at 10:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.