3

I've been wondering if there's a possibility to find the IP addresses of all the nodes connected to a particular LAN without assigning your NIC an IP address.Taking under consideration that some nodes are on different IP subnets.

I'm aware of tools such as angryipscanner, nmap, arp-scan and etc, but they all need an IP address assigned to you NIC in turn to use then.

I was thinking if there's a way to use libpcap or another tool in turn to forge an ARP-request frame and make all the nodes within the LAN answer to the broadcast address ( so you could sniff it) or to the port where my NIC is connected to.

  • I'm specifically interested in assigning my NIC with an IP address, which will not conflict with another one on the LAN. – mario May 31 '15 at 20:37
  • 1
    You could perform duplicate address detection for that case. Take a look at RFC 5227 tools.ietf.org/html/rfc5227 – Sander Steffann Jun 1 '15 at 0:33
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 16:58
5

I was thinking if there's a way to use libpcap or another tool in turn to forge an ARP-request frame and make all the nodes within the LAN answer to the broadcast address ( so you could sniff it) or to the port where my NIC is connected to.

It doesn't have to be that complicated.

As long as your switch isn't using a feature similar to Dynamic ARP Inspection, the simple way to detect addresses is to use arping... you can find this in most linux distributions (although CLI options sometimes vary depending on what arping build you have).

[mpenning@home ~]$ sudo arping -c 2 -S 0.0.0.0 -D -i eth0 172.16.100.40
ARPING 172.16.100.40
60 bytes from 00:ae:de:ad:be:ef (172.16.100.40): index=0 time=3.513 msec
60 bytes from 00:ae:de:ad:be:ef (172.16.100.40): index=1 time=2.778 msec

You can write a script to cycle through as many addresses as you like; usually it's a good idea to sniff with wireshark and see what subnets could be used in that vlan (i.e. by looking at the source address in ARP requests).

Dynamic ARP Inspection

If you are running Dynamic ARP Inspection (DAI), you can't detect addresses like this as long as DAI checks IP address validity... I tested this on a Cisco 2960 running this configuration:

ip arp inspection vlan 100
ip arp inspection validate src-mac dst-mac ip

When I used arping as shown above, the switch noticed the invalid 0.0.0.0 source IP address in the ARP frame, and dropped it:

Jun  1 04:05:29.561 CDT: %SW_DAI-4-INVALID_ARP: 1 Invalid ARPs (Req) on Gi0/1, 
vlan 100.([0024.1bde.add7/0.0.0.0/0000.0000.0000/172.16.100.40/04:05:28 CDT 
Mon Jun 1 2015])
1

Your idea is quite good. Using libpcap to capture all arp-broadcasts and learn the MAC and IP adresses of all active nodes will work.

I do this on a box in our network to compile a list of all nodes and have a searchable arp table. It listens on a vlan trunk and has no IP address in most of the VLANs. It's a little daemon in perl i hacked together in one afternoon.

0

Mario, you mentioned:

Taking under consideration that some nodes are on different IP subnets.

Unfortunately you cannot traverse subnets without an IP address. arping will do exactly what you want, except only on a single subnet/VLAN. If you'd like to scan the next network, you'll need to change the VLAN your "scanning" PC is on then re-run arping.

If you have a large amount of VLANs and the above solution would be too time consuming, you could either:

  1. Install Angry IP (or any other IP scanner) on an existing server which has an IP address.
  2. Find a spare IP on any subnet and assign it to a spare PC or server. You can then use this PC/server to perfom scans.

Doing either of these two things will allow you to scan all subnets without having to move your PC/server from VLAN to VLAN.

  • 3
    Keep in mind that "different IP subnets" != "different VLAN"; while this is often the case, it is not always so. As long as the different IP subnets are part of the same L2, then you definitely can reach them and get a response without an IP address. – YLearn Jun 4 '15 at 1:01
  • 1
    VLANs and subnets have no required relation to each other. arping will be constrained by a single broadcast domain (which may or may not be a single VLAN), and that broadcast domain may have many subnets. – Nick Bastin Dec 29 '15 at 10:29

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.