RE: Mapping Class A network ( any easy trick?)

From: Brass, Phil (ISS Atlanta) (PBrass_at_iss.net)
Date: 02/09/05

  • Next message: X-Force: "ISS Protection Brief: F-Secure AntiVirus Library Heap Overflow"
    Date: Tue, 8 Feb 2005 19:49:01 -0500
    To: "John Thomas" <mjohn2000_99@yahoo.com>, <pen-test@securityfocus.com>
    
    

    Look for tools like THC RUT (http://www.thc.org/thc-rut), scanrand
    (http://www.doxpara.com/paketto-2.00pre3.tar.gz), and fping
    (http://www.fping.com/) to do fast sweeps of your address space,
    identifying all responding hosts. Set up windows every 8 hours (or
    whatever), gather all the responding hosts in that window and kick off
    the next-higher-level scan on those hosts. Nmap ping scans (-sP) also
    work well and most of them are quite fast. Try all the different sorts,
    UDP pings, TCP SYN and ACK (to different ports), and ICMP echo,
    timestamp, and netmask. Sweep for accessible SNMP hosts with a fast
    tool like onesixtyone (http://www.phreedom.org/solar/onesixtyone/). You
    can use ICMP netmask results, traceroute results, and any SNMP routing
    tables, to assemble a moderately good view of the network.

    Good luck!

    Phil

    -----Original Message-----
    From: John Thomas [mailto:mjohn2000_99@yahoo.com]
    Sent: Tuesday, February 08, 2005 11:42 AM
    To: pen-test@securityfocus.com
    Subject: Mapping Class A network ( any easy trick?)

    I am about to do a penetration testing on a "Class A
    network" and wondering how I can map the network
    without pinging 17 million IPs.(nmap -Sp 10.0.0.0/8)

    I did some research and the best information I got is
    from one of the earlier post on this
    list(http://seclists.org/lists/pen-test/2004/Jul/0067.html)
    . It was to use broadcast IPs for pings. But it may miss some subnets.

    Is that the best way to it? If not, please advise


  • Next message: X-Force: "ISS Protection Brief: F-Secure AntiVirus Library Heap Overflow"