Scanning a network isn't just the domain of malicious hackers and script kiddies - it's also something perfectly reasonable system administrators do. There are plenty of reasons to scan a network. We won't dwell on them, but we'll tell you which tool you can use to do this on FreeBSD.
So, meet nmap. The utility is available right from ports.
Installing
$ cd /usr/ports/secutiry/nmap
$ sudo make install clean
Using itGeneral usage:
$ sudo nmap 192.168.0.0/24
where instead of 192.168.0.0/24 you specify the subnet you need.
Scanning in this mode won't be quick - let's just say you'll have time for a cup of tea with cookies and pretzels for sure. That's because it will scan EVERYTHING.
As a result, the utility will output a set of reports like these:
Interesting ports on mycomputer.mydomain (192.168.0.10):
Not shown: 1674 closed ports
PORT STATE SERVICE
80/tcp open http
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
3306/tcp open mysql
3389/tcp open ms-term-serv
MAC Address: FE:16:3E:68:FC:67 (Unknown)
Excluding certain segmentsFor example, we need to test 192.168.0.0/24 except for hosts 192.168.0.10 and 192.168.0.22 and a small subnet 192.168.0.200/31:
$ sudo nmap --exclude 192.168.0.10,192.168.0.22,192.168.0.200/31 192.168.0.0/24
List of hosts/networks from a file
$ sudo nmap -iL myfile.txt
Ping-only scanning (fast)
$ sudo nmap -sP 192.168.0.0/24
Which will show you a result like this:
Host server1.mydomain (192.168.0.10) appears to be up.
Host computer2.mydomain (192.168.0.11) appears to be up.
Host 192.168.0.13 appears to be up.
Host 192.168.0.23 appears to be up.
Host 192.168.0.111 appears to be up.
Host 192.168.0.250 appears to be up.
Nmap finished: 256 IP addresses (6 hosts up) scanned in 10.291 seconds
And if the scan covers a subnet within direct visibility of the network adapter, the output will also include MAC addresses:
...
Host 192.168.0.61 appears to be up.
MAC Address: 00:15:94:10:00:56 (Bixolon Co.)
Host comp68.hotels (192.168.0.68) appears to be up.
MAC Address: 00:1F:C6:B4:CB:2F (Unknown)
Host 192.168.0.110 appears to be up.
MAC Address: 00:15:65:11:46:BC (Xiamen Yealink Network Technology Co.)
...
Disabling DNS resolution
$ sudo nmap -n 192.168.0.0/24
or like this (for ping-only):
$ sudo nmap -n -sP 192.168.0.0/24
Scanning only specific ports
$ sudo nmap -p 21,22,23,1024-2048 192.168.0.0/24
or, splitting into TCP and UDP:
$ sudo nmap -p U:53,1024,T:21,22,80 192.168.0.0/24
Trying to determine the operating system type
$ sudo nmap -O 192.168.0.0/24
Honestly, OS detection is hit-or-miss, so it's mostly useful when you need to distinguish Windows from Unix.
Showing all hosts/IPs in the range, even if nothing was found there
$ sudo nmap -v 192.168.0.0/24
Showing free IP addresses in a given rangeThis is the reverse job - we want to see not the occupied IPs, but the opposite: addresses that are not currently occupied by any computer.
Keep in mind that if some piece of hardware is turned off during the scan, or is behind a firewall and doesn't respond, but still has an IP - you'll get a far from accurate picture!
$ sudo nmap -v -sP 192.168.0.0/24 | grep down
More, more...There are many more options - see man nmap.
Here we've covered only the most handy ones.
Comments