IP finding...

berkay · 09-13-2004, 11:28 AM

I want a program which detects all the ip's in the LAN network which I also belong to it... I'm not server, i am only a client like other pc's...

PS: In short, I want an arp-viewer like program for linux

Here is the link for arp-viewer...
http://www.depicus.com/wake-on-lan/wake-on-lan-arp.asp

PS2: Sorry for my eng...

Thanks a lot

qwijibow · 09-13-2004, 01:03 PM

so you basically want to ping scan the network to test which machines are up.
you can do this with nmap. make sure nmap is installed, then read "man nmap"

for example....

nmap -sP -T Insane 192.168.0-255.0-255

will ping scan all IP's from 192.168.0.0 to 102.168.255.255

or just use the frontend... nmap-fe

berkay · 09-13-2004, 02:46 PM

Thanks qwijibow,

nmap is the program... It has much more features than a simple arp-viewer...

qwijibow · 09-13-2004, 03:45 PM

its main use is a port scanner for detecting possible security issues in your network...

be causrefull you only use the ping scan function, if you accidently port scan some1 you could get yourself into trouble.

berkay · 09-13-2004, 04:22 PM

You mean like -sV?

How could that cause a problem?

qwijibow · 09-14-2004, 07:24 AM

nmap is a great tool for finding security holes in your system...
its also one of the first steps an attacker may use to compromise a system...

its very good at detecting what servers are running, what software and what version.
if you start port scanning other people, they will think you intend to attack there system.

im just saying,,, dont port scan a computer that doesnt belong to you !
even if you dont have any bad intentions, it will be annnoying for any1 who needs to read the firewall logs.

DrNeil · 09-14-2004, 08:45 AM

Quote:

Originally posted by qwijibow

even if you dont have any bad intentions, it will be annnoying for any1 who needs to read the firewall logs.

Now I just wonder if nmap can detect ports and programs why not turn the issue around. Detecting a portscan and feed back shitty information. Is there something like this about for all the common scanners? I mean if nmap etc can detect apache 1.3.6/bind 9 etc a reverse program could detect an nmap finger print and have some fun.

qwijibow · 09-14-2004, 08:51 AM

no
just no...

it just doesnt work like that.

suppose it could be done... but after your security program detects a port scan, it would have to kill all your servers so that it can have sontroll over the ports they listen too...

then bringing down a server would be as easy as port scanning it....

there wouldnt be any need for dstributed denial of serive attacks.

stupid idea.

it would be much better to just block an IP for 10 mins if it starts a port scan.

DrNeil · 09-14-2004, 09:33 AM

Quote:

Originally posted by qwijibow
it would be much better to just block an IP for 10 mins if it starts a port scan.

Protocols can be changed. Router informs server server drops connection, router takes over feeds back crap ..

Anyway blocking an ip is fair enough in the first instance.