Host Discovery

IP

Local IP

ip addr show dev tun0

ipv6

ip -6 addr show dev tun0

Find local hosts:

ip neigh

IPv6 hosts:

ip -6 neigh

How do I change the state of the device to UP or DOWN?

The syntax is as follows: ip link set dev {DEVICE} {up|down}

Nmap

Useful parameters:

netdiscover

Discovers IP, MAC Address and MAC vendor on the subnet from ARP, helpful for confirming you're on the right VLAN at client site

netdiscover -r 192.168.1.0/24

Results:

 Currently scanning: Finished!   |   Screen View: Unique Hosts                  
 4 Captured ARP Req/Rep packets, from 4 hosts.   Total size: 240                
 _____________________________________________________________________________ 
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname       
 ----------------------------------------------------------------------------- 
 192.168.17.1    00:50:56:c0:00:08      1      60  VMware, Inc.                 
 192.168.17.2    00:50:56:e5:1f:80      1      60  VMware, Inc.                 
 192.168.17.131  00:0c:29:31:8a:2b      1      60  VMware, Inc.                 
 192.168.17.254  00:50:56:f1:23:55      1      60  VMware, Inc.     

ARP

root@kali:~/Documents/Training# arp-scan -l -v -I wlan0  
Interface: wlan0, datalink type: EN10MB (Ethernet) 
Using 192.168.1.0:255.255.255.0 for localnet 
Starting arp-scan 1.9.5 with 256 hosts (https://github.com/royhills/arp-scan) 
192.168.1.1 00:1d:aa:15:e5:28 DrayTek Corp. 
192.168.1.2 7c:4c:a5:76:14:54 BSkyB Ltd Padding=0f3d00100000000100000000000000000000 
192.168.1.3 c4:71:54:30:5f:cc (Unknown) 
192.168.1.11 94:c6:91:a1:1e:c6 (Unknown) 
192.168.1.17 f0:03:8c:67:a0:49 AzureWave Technology Inc.  
Padding=ea92d2071ad532a1a4afe6ff000000000000 
192.168.1.17 f0:03:8c:67:a0:49 AzureWave Technology Inc.  
Padding=882079afbeb6ee4c29bcf66f000000000000 (DUP: 2) 
192.168.1.18 98:01:a7:89:5b:e7 Apple, Inc. Padding=6fb47320fa70a613398d8560020405b40402 
192.168.1.25 d4:6e:0e:18:40:3b TP-LINK TECHNOLOGIES CO.,LTD.  
Padding=8aa9f02e679cb9dfd238cef2000000000000 
192.168.1.33 98:01:a7:89:5b:e7 Apple, Inc. 
192.168.1.12 18:1d:ea:9d:b9:17 (Unknown) 
--- Pass 1 complete 
192.168.1.34 18:1d:ea:9d:b9:17 (Unknown) 
192.168.1.21 d4:25:8b:e6:b2:c5 (Unknown) 
--- Pass 2 complete 

12 packets received by filter, 0 packets dropped by kernel 
Ending arp-scan 1.9.5: 256 hosts scanned in 2.412 seconds (106.14 hosts/sec). 12 responded 

OneLiners - Ping sweep

Windows

for /L %i in (1,1,255) do @ping -n 1 -w 200 172.21.10.%i > nul && echo 192.168.1.%i is up.

Linux

for i in {1..254} ;do (ping -c 1 172.21.10.$i | grep "bytes from" &) ;done

Last updated