LinuxQuestions.org
Did you know LQ has a Linux Hardware Compatibility List?
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 08-29-2009, 04:50 AM   #1
Zeratul021
LQ Newbie
 
Registered: Aug 2009
Location: Prague
Distribution: Kubuntu 8.10
Posts: 11

Rep: Reputation: 0
Scan whole network for physical members


Hi,

I want to ask if it is possible under linux to scan network for computers while wanting theirs NIC MAC. I know about arp-scan but that works on higher OSI layer with logical addresses. What I need is to see every member in network indifferent to their logical network.

I think there is some way with SNMP on CISCOs, but is there any cli tool in linux for that?

Thanks in advance,

Marek

P.S. My first post, but this forum helped me many times before
 
Old 08-29-2009, 08:29 AM   #2
markush
Senior Member
 
Registered: Apr 2007
Location: Germany
Distribution: Slackware
Posts: 3,970

Rep: Reputation: 848Reputation: 848Reputation: 848Reputation: 848Reputation: 848Reputation: 848Reputation: 848
Hello Zeratul021 and welcome to LQ,

I don't know if I've fully understood your question. The function of the arp-protocol is to connect the MAC-Adresses of a network-member to its IP-adress. The only situation which I can think of, where it would be more complicated is when a member of a TCP/IP-network has an ip-adress of another subnet. So this machine will be invisible for protocols in the TCP/IP family. Then one has to use something like an arp-broadcast. As far as I know there are arp-scanners which can handle such a situation.

What do you mean with "logical network"?

Markus
 
Old 08-30-2009, 05:36 AM   #3
Zeratul021
LQ Newbie
 
Registered: Aug 2009
Location: Prague
Distribution: Kubuntu 8.10
Posts: 11

Original Poster
Rep: Reputation: 0
Hey,

I think you understood, I need it for finding hidden routers in network which are in different subnet = logical network, but on the same cable network = physical network. Yes, arp broadcast sounds like a good idea but I don't know about any command to do something like that. And actually thank you because I got an idea now... and it seems to work:
sudo arp-scan 0.0.0.0:0.0.0.0

Marek
 
Old 08-30-2009, 05:47 AM   #4
markush
Senior Member
 
Registered: Apr 2007
Location: Germany
Distribution: Slackware
Posts: 3,970

Rep: Reputation: 848Reputation: 848Reputation: 848Reputation: 848Reputation: 848Reputation: 848Reputation: 848
Hi,

wasn't it arp-scan "FF FF FF FF FF FF"?

Another solution would be to change the subnetmask of your machine to a lower value. For example, if I have a machine with ip 192.168.24.3/24 and I'm searching for a machine in the same physical subnet with an ip between 192.168.1.1 and 192.168.254.254, I could change my ip-settings to 192.168.24.3/16. But I don't really know if this will work.

I know this problem from networkprinters which have been in another network before I installed them and which have a static IP.

Markus
 
Old 08-31-2009, 03:02 AM   #5
Zeratul021
LQ Newbie
 
Registered: Aug 2009
Location: Prague
Distribution: Kubuntu 8.10
Posts: 11

Original Poster
Rep: Reputation: 0
Quote:
Originally Posted by markush View Post
Hi,

wasn't it arp-scan "FF FF FF FF FF FF"?

Another solution would be to change the subnetmask of your machine to a lower value. For example, if I have a machine with ip 192.168.24.3/24 and I'm searching for a machine in the same physical subnet with an ip between 192.168.1.1 and 192.168.254.254, I could change my ip-settings to 192.168.24.3/16. But I don't really know if this will work.

I know this problem from networkprinters which have been in another network before I installed them and which have a static IP.

Markus
Don't know about that FF - doesn't seem syntacticaly right, but lowering mask isnt enought as it can be any of private networks or even in multimedial ranges (236.0.0.0/8) so my suggested command should theoretically work because 0.0.0.0:0.0.0.0 is default route meaning any ip. But practically it consumes too much memory and probably needs to be run from script for /8 subnets 256 times - accoriding to man page this subnet scan consumes cca 400 MB memory.

Marek
 
  


Reply

Tags
arp, network, physical, scanning


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
reading all physical volumes scan on the beginning matters Slackware 2 06-06-2007 12:19 PM
Network Scan mushtaq Linux - Networking 7 09-28-2006 06:06 AM
Tool for HDD physical scan somarasa Mandriva 4 06-24-2005 02:53 AM
how can I scan my network :King_58: Linux - Networking 9 09-13-2004 08:38 AM
Routing when Connected in the same physical network aaronsols Linux - Networking 6 03-24-2002 10:07 PM


All times are GMT -5. The time now is 05:23 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration