IP Scanners.. Do they just ping?

[abillybob]

Hi All

 

I've got "IP Scanner Pro" on my mac and I've joined my Mac to a VLAN to perform a scan. I presume this software only finds each device's IP address if it recieves a reply from a ping although it seems to find other information such as the devices manufacturer and what type of device it is.

 

I'm clearing up the DHCP on this VLAN to save some IP's so want to know if it gives off a true impression on what's on a network or whether it just guesses by pinging every IP? Obviously the latter could be a problem as a device might not have ping requests allowed.

 

Thanks

[localzuk]

Most tools like that do just ping the address - else there's not really any way to get the machine to say "I'm here".

[Koldov]

I presume this software only finds each device's IP address if it recieves a reply from a ping although it seems to find other information such as the devices manufacturer and what type of device it is.

 

Most tools like that do just ping the address - else there's not really any way to get the machine to say "I'm here".

 

Interesting point though...

 

I use Angry IP Scanner and it returns the Hostname (even on ones that are 'dead') and yet sometimes doesn't return the Hostname on ones that are 'alive'...

 

 

Not sure whether this is something to do with my other post on DNS (should it be reading DNS from the server?):

 

http://www.edugeek.net/forums/windows-server-2012/207474-nslookup-fails-reverse-dns-issue.html

 

Or if it's something to do with entries in the config of the machine - WINS/NetBios etc. (not possible if the machine is 'dead'), not my strong point, so I've always wondered how/why..

Edited June 14, 2019 by Koldov

[rrrrr]

Hi All

 

I've got "IP Scanner Pro" on my mac and I've joined my Mac to a VLAN to perform a scan. I presume this software only finds each device's IP address if it recieves a reply from a ping although it seems to find other information such as the devices manufacturer and what type of device it is.

 

I'm clearing up the DHCP on this VLAN to save some IP's so want to know if it gives off a true impression on what's on a network or whether it just guesses by pinging every IP? Obviously the latter could be a problem as a device might not have ping requests allowed.

 

Thanks

There are 3 good tools you can use on your mac.

Nmap, arpscan and masscan

 

Nmap is a port scanner. If you want to look for windows boxes on your network do a syn scan on smb

Nmap -p 445 —open

If you want to find systems that dont respond to ping use -Pn but will be a bit slower

 

Arp-scan —local will enumerate all systems on your vlan by arp requests

 

If your looking for systems site wide use masscan. Its very fast but only really works on a /16 range

Masscan -p 445 —rate=1000

[Koldov]

I'm clearing up the DHCP on this VLAN to save some IP's so want to know if it gives off a true impression on what's on a network

 

Actually, just looking at DNS on my Windows Server (not sure how yours is run), mine is set to scavenge every 7 days, but could you have a look at the timestamp on I.P. addresses in there.

 

Are you having trouble with DHCP not giving out addresses? Or do you have any static I.P.s clogging things up?

 

We don't run DHCP (it is done on our managed switches) so I can't help you with specifics, just throwing some ideas around...

[tom_newton]

There are a few ways to tell if a host is up that aren't traditional ICMP PING. The nmap documentation is pretty useful here:

https://nmap.org/book/man-host-discovery.html

[bald_pig]

Hi All

 

I've got "IP Scanner Pro" on my mac and I've joined my Mac to a VLAN to perform a scan. I presume this software only finds each device's IP address if it recieves a reply from a ping although it seems to find other information such as the devices manufacturer and what type of device it is.

 

I'm clearing up the DHCP on this VLAN to save some IP's so want to know if it gives off a true impression on what's on a network or whether it just guesses by pinging every IP? Obviously the latter could be a problem as a device might not have ping requests allowed.

 

Thanks

 

Most scanners will just ping, more advanced ones are available.

 

Why are you manually deleting dhcp leases? The whole point of DHCP is to automatically assign and release ip addresses, if you need to go in and delete things to make space then you've set it up wrong.