4

I want to scan for powered on computers on my LAN and gather logs about that. I tried nmap but it didn't work very well (a lot of switched on computers are not getting detected).

nmap -sP 192.168.2.0/24
Nmap done: 256 IP addresses (10 hosts up) scanned in 6.07 seconds

I also thought about looking at network TCP packets for IPs, but I don't know of any tool ready to do that.

On this network, all computers have static IPs associated, so a IP identifies a computer. The PCs have different operating systems (Windows 7, Ubuntu 10.04, Ubuntu 12.04 and more).

What's my best chance?

6 Answers 6

3

Have you tried other scan options from nmap? The ping option may not always work, but other scan options may be more reliable? Try,

nmap -PS 192.168.2.0/24 (TCP SYN ping)

or

nmap -PR 192.168.2.0/24 (ARP scan)

5
  • 1
    ARP scan will work best on LAN, a machine must respond to ARP query always, no matter the firewall configuration. Windows by default blocks ICMP Echo so nmap -sP won't detect them Jan 18, 2013 at 10:17
  • -PS reports 16 hosts up, while -PR reports 14. There are, at least, 60 hosts up right now :( Jan 18, 2013 at 10:30
  • @JorgeSuárezdeLis are you scanning from a machine in the same subnet/VLAN? Are you performing the scan as root? Jan 18, 2013 at 10:32
  • Both answers: yes Jan 18, 2013 at 11:39
  • For a privileged (root) scan on a local subnet, Nmap defaults to using ARP scan. You can get the default host discovery (ICMP Echo, TCP 80 SYN, TCP 443 ACK, ICMP Timestamp) by using --send-ip or --unprivileged Jan 18, 2013 at 12:58
2

Try Look@LAN to scan for powered on computers.

There are alternatives to Look@LAN and some of them are even free or free and open source.
Personally I can recommend the Angry IP Scanner which is OpenSource and multiplatform or Advanced IP Scanner which is made for Windows platforms and not OpenSource but free.

6
  • I'd prefer FOSS software whenever possible. Thank you anyways! Jan 18, 2013 at 16:25
  • I've added some alternatives
    – wullxz
    Jan 18, 2013 at 18:47
  • Thanks, Angry IP Scanner is a nice application, but only for interactive usage. I want to gather some logs automatically, and a cli application is better. I've already resolved this issue with nmap anyway. Jan 20, 2013 at 2:59
  • ok, no problem. Please don't forget to mark your answer as valid answer then. ;)
    – wullxz
    Jan 21, 2013 at 22:12
  • Kinda unrelated, but do you know how to format the "IP List file" when using Angry IP Scanner? I can't find doco on it anywhere. Feb 5, 2014 at 0:41
1

ping -b the broadcast IP then arp -a

5
  • 1
    afaik, only linux clients will respond to a broadcast (if not explicitly blocked). Windows clients don't.
    – wullxz
    Jan 18, 2013 at 9:58
  • arp -a on a router should have all the machines though. If one does have a domain controller, running arp -a on it should give similar results Jan 18, 2013 at 10:21
  • 1
    Some of the target machines aren't windows, so the Domain Controller option is probably not that useful. Jan 18, 2013 at 10:24
  • FWIW, I just tried ping -b followed by arp -a and the results were missing two machines I know to be switched on. Jan 18, 2013 at 12:28
  • I tried it myself and I got all the machines (even the windows machine and a windows vm whose not showed with ping -b BroadcastIP Jan 18, 2013 at 12:30
1

It seems that the problem was the probing rate (too much packets per second?). Using the parameter --max-rate made it performance much better. It takes ages to run, but at least it works.

$ nmap -sP --max-rate 1  192.168.2.0/24
...
Nmap done: 242 IP addresses (67 hosts up) scanned in 434.04 seconds
1

ARP scan (-PR) is the default in a LAN. Besides, you can also use advanced ping options such as nmap -PS21-23,80,135,139,443,445 target

Or scan the 1000 most common ports (or even all ports -p-) without ping nmap -Pn -p- target which is somewhat slower.

0

arpwatch can come very handy for getting a first impression on what is going on; the be-all-end-all tool to see details would be wireshark (even better in conjunction with a switch that has a monitoring port configured or a similar network tap). BTW, since you appear to be new to such techniques: using such tools in a professional setting is acceptable in two situations: a) you are a developer and analysing ONLY the traffic concerning your application under test, b) you are among the people responsible for the network/infrastructure/servers and/or have have been asked or allowed to do so by these people. Anything else will usually be considered suspicious or hostile activity by the same people and might lead to having some explaining to do.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.