Situation : Along with other active hosts, our internal network scan shows an extra 9 IP addresses in the report (no reverse DNS, just IP addresses) with 0 vulnerabilities and 2 INFO
INFO1 : Nessus scan information INFO2 : Traceroute : 1 hop.
Problem : No one in the organization knows which IP addresses are these.
I picked up one of the IP addresses : 10.33.10.47
From one(10.33.162.115) of the servers, I tried to reach/scan 10.33.10.47 and:
Time to live exceeded
2) A regular
nmap -sT scan says the host is up, but no ports open.
wireshark analysis of the packets I captured while running the
nmap shows the destination MAC address of our Cisco firewall in the Layer 2 section.
I am yet to hear back from our network team to see if they can find something from the ARP tables. How would I know whether this host is Live or dead. Both the scanning tool(Nessus) and
nmap says the host is up, but I am, in no way, able to reach that host.
P:S:- I have posted another question about the same problem, but editing the original question to add my later findings (and there by editing the whole question) would leave a good answer I received on that question slightly out of context, so I have posted this as another question. Hope it is okay.