3

What's the easiest way to get a list of windows desktops that are on a subnet but do not have names listed in the dns server?

5 Answers 5

6

You could use nmap

nmap 192.168.1.0/24

would give you a listing of all the IPs being used on the subnet, along with their open ports.

4
  • This is perfect because the windows boxes are not going to have port 23 open but the unix boxes will
    – sal
    Commented May 1, 2009 at 16:55
  • Why would unix boxes have port 23 open today? Sounds like a "mal"configuration to me ;) Commented May 1, 2009 at 18:06
  • If you don't want need the port scan info, -sP will just check if the host is up. You might want to specify which DNS server with --dns-servers. If a machine is offline but has a DNS entry, -R might be useful. My suggestion for a fast scan is: nmap 192.168.0.1/24 -sL -R | grep -v "(.*)" There are better ways to grep the output, but this does the job quite well. -sL doesn't even check that the machine is up, just sends the DNS queries, -R make sure the DNS queries are sent. Thee grep outputs only those lines without prens, those without dns entries, remove -v to get those with.
    – alif
    Commented May 1, 2009 at 20:08
  • doh! confused telnet and ssh port numbers.
    – sal
    Commented May 1, 2009 at 20:37
1

The nmap tool will do both. However, get permission in writing to run it before you do so. Most organizations would classify it a security tool (it is) and most have explicit policies about getting permission before executing such tools.

1

The following is my follow up to the selected answer.

If you don't need the port scan info, -sP will just check if the host is up. You might want to specify which DNS server with --dns-servers. If a machine is offline but has a DNS entry, -R might be useful. My suggestion for a fast scan is:

nmap 192.168.0.1/24 -sL -R | grep -v '(.*)' | awk '{print $2}'

There are better ways to grep the output, but this does the job quite well. -sL doesn't even check that the machine is up, it just runs through the list of IPs, -R sends DNS queries for all IPs, not just ones that are up - nmap won't know which are up and does not do DNS queries on down hosts by default. The grep outputs only those lines without prens -- those without DNS entries; remove -v to get only those with DNS entries, but you'll have to change the the grep/awk to parse the IPs it that case.

Output example:

$ nmap 192.168.0.1/24 -sL -R | grep -v '(.*)' | awk '{print $2}'
192.168.0.0
192.168.0.1
192.168.0.2
192.168.0.3
# ...

Those are the IPs that have no DNS entries.

1
  • This is very cool. I managed to come up with something less elegant using grep and cut
    – sal
    Commented May 1, 2009 at 20:41
0
  1. get a list of your Windows desktops and their names
  2. for each one, ask the DNS server if they're listed...

If you can't do (1), you've got bigger problems...

0

Advanced ip scanner might help.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .