Script for scanning the network

[Karthik S S]

We have about 3000+ systems in our network. ( And more than 4000+ entries are in DNS and most of them are outdated ). Now we basically want to find out which are all the alive systems ( By doing a ping - which may not be very accurate considering that some systems may be down when we are trying to ping or some may reject the ping requests ). And also we want to figure out the OS running on those hosts ( Linux's nmap can do this ) and make separate lists for the hosts with different OSs. Do any body have some tailor made scripts for this task. Or can you please suggest me how effectively I can accomplish this task?

Thanks
Karthik

[Robin Wakefield]

Hi Karthik,

Does the following help at all - I am unfamiliar with nmap, so have simply put a remsh to the server to get the OS type:

=============================
#!/usr/bin/ksh
ypcat hosts | awk '{print $2}' | while read HOST ; do
# Check that the server is alive
echo "$HOST .."
/etc/ping $HOST 8 1 | grep 100% >/dev/null 2>&1
if [ $? -eq 0 ]; then
echo "++ $HOST down"
continue
fi
OS=`remsh $HOST -n uname -s`
echo $HOST >> /tmp/$OS
done
=============================

rgds, Robin

[Karthik S S]

Hi Robin,

For the above script first of all I should be having .rhosts entries in all the hosts which is not the case here. Also there are different variants of OSs in our network like Windows XX, Mac OS, Netware, Unix variants .... for which the uname -s may not work ..

Thanks
Karthik

[Chris Wilshaw]

FTP may be of limited use to you;

ftp -v -n << EOF
quit
EOF

This gives the following on MS servers.

220 Microsoft FTP Service (Version 4.0).
221

It can't narrow down the windows version, but at least you know it's a windows system.

For UX servers, it will depend on the version of ftpd, and how (or if) it is set up as to what info you can get back.

[Huc_1]

hello

I found nmap for HP at http://www.insecure.org/nmap/index.html

I have never used this on a HP use it on Linux

You could do a

nmap -O 'xxx.xxx.xxx'

then on the host that did not return an os but have telnet or ftp or finger some other usefull port open

you could do something like

telnet 'xxx.xxx.xxx' port_number

output the result of this to a file

all of the above could go in a script, I have use this technique by typing it from shell when I find some unexpected connection in my security log on linux.

Hope this helps, Jean-Pierre Huc

[Karthik S S]

Hi Jean,

I used linux's nmap to collect the data. I tried nmap for hp-ux but found it to be slower and inaccurate that the prior.

Thanks
Karthik