Finding all used IP addresses within a LAN without assigning an IP address to your NIC

Question

I've been wondering if there's a possibility to find the IP addresses of all the nodes connected to a particular LAN without assigning your NIC an IP address.Taking under consideration that some nodes are on different IP subnets.

I'm aware of tools such as angryipscanner, nmap, arp-scan and etc, but they all need an IP address assigned to you NIC in turn to use then.

I was thinking if there's a way to use libpcap or another tool in turn to forge an ARP-request frame and make all the nodes within the LAN answer to the broadcast address ( so you could sniff it) or to the port where my NIC is connected to.

Answer 1

I was thinking if there's a way to use libpcap or another tool in turn to forge an ARP-request frame and make all the nodes within the LAN answer to the broadcast address ( so you could sniff it) or to the port where my NIC is connected to.

It doesn't have to be that complicated.

As long as your switch isn't using a feature similar to Dynamic ARP Inspection, the simple way to detect addresses is to use arping... you can find this in most linux distributions (although CLI options sometimes vary depending on what arping build you have).

[mpenning@home ~]$ sudo arping -c 2 -S 0.0.0.0 -D -i eth0 172.16.100.40
ARPING 172.16.100.40
60 bytes from 00:ae:de:ad:be:ef (172.16.100.40): index=0 time=3.513 msec
60 bytes from 00:ae:de:ad:be:ef (172.16.100.40): index=1 time=2.778 msec

You can write a script to cycle through as many addresses as you like; usually it's a good idea to sniff with wireshark and see what subnets could be used in that vlan (i.e. by looking at the source address in ARP requests).

Dynamic ARP Inspection

If you are running Dynamic ARP Inspection (DAI), you can't detect addresses like this as long as DAI checks IP address validity... I tested this on a Cisco 2960 running this configuration:

ip arp inspection vlan 100
ip arp inspection validate src-mac dst-mac ip

When I used arping as shown above, the switch noticed the invalid 0.0.0.0 source IP address in the ARP frame, and dropped it:

Jun  1 04:05:29.561 CDT: %SW_DAI-4-INVALID_ARP: 1 Invalid ARPs (Req) on Gi0/1, 
vlan 100.([0024.1bde.add7/0.0.0.0/0000.0000.0000/172.16.100.40/04:05:28 CDT 
Mon Jun 1 2015])

Answer 2

Your idea is quite good. Using libpcap to capture all arp-broadcasts and learn the MAC and IP adresses of all active nodes will work.

I do this on a box in our network to compile a list of all nodes and have a searchable arp table. It listens on a vlan trunk and has no IP address in most of the VLANs. It's a little daemon in perl i hacked together in one afternoon.

Answer 3

Mario, you mentioned:

Taking under consideration that some nodes are on different IP subnets.

Unfortunately you cannot traverse subnets without an IP address. arping will do exactly what you want, except only on a single subnet/VLAN. If you'd like to scan the next network, you'll need to change the VLAN your "scanning" PC is on then re-run arping.

If you have a large amount of VLANs and the above solution would be too time consuming, you could either:

1. Install Angry IP (or any other IP scanner) on an existing server which has an IP address.
2. Find a spare IP on any subnet and assign it to a spare PC or server. You can then use this PC/server to perfom scans.

Doing either of these two things will allow you to scan all subnets without having to move your PC/server from VLAN to VLAN.