1

I have a big network that contains hosts of different types (industrial, computers,servers,iot,etc.).

All the hosts are within the same central building.

I need to identify all the hosts passively, without using any active scanner like nmap because of the presence of old and fragile industrial equipment.

I have access to the core switch (HP H3C S7503E) and to the access switches too (3C 5500-EI PWR 52)

What is the best approach to accomplish this?

Thanks.

closed as primarily opinion-based by Ron Maupin Mar 7 at 15:53

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Unfortunately, product or resource recommendations are explicitly off-topic here, so we cannot suggest any tools, that you can use. – user36472 Mar 7 at 9:39
  • 1
    Okay , I edited my message. – HDH Mar 7 at 9:47
  • Asking for "the best" leads to primarily opinion-based answers, which are off-topic here. You could ask for something like experiences. See the What types of questions should I avoid asking? page for guidance. – Ron Maupin Mar 7 at 16:05
  • MAC/CAM tables on the switches. If it's on and talking, it'll be known to the switches. – Ricky Beam Mar 7 at 22:03
3

You can slow Nmap's discovery way down, so it won't disturb fragile equipment.

First do a simple ping sweep. You can go very slow, taking hours (or days) if need be.

Once you know the active hosts, use their MAC address to look up the vendor by OUI. This will help you identify industrial devices from PCs. It's not 100% reliable, but it will give you a very good approximation.

From there, You can decide which devices need further probing. Again, you can go as slow as you want.

2

If all relevant traffic runs across the core switch and there's enough link headroom you could set up port mirroring to a monitor port on the core switch, capture and analyze the traffic. Provided a single port isn't overwhelmed by the amount of traffic, you'd catch every single frame running across the core switch.

Alternatively, you can tap each core switch port separately to see what kind of traffic it carries.

If there's relevant traffic inside the access switches you'd need to tap them as well. However, mirroring that traffic through the core uplink isn't advisable unless there's plenty of headroom on the link. I'd use a separate, dedicated monitoring link to the monitoring system.

Alternatively, you could use sFlow or Netflow to monitor larger flows. The downside is that these don't capture every single frame but use a statistical subset. Depending on what you're looking for, that flow may or may not be represented. The upside is that you can run sFlow/Netflow continuously without any dedicated cabling.

0

You can watch all ARP request, any equipment which have to send a packet will generate an ARP request to know the MAC address of the destination, and tell his own address at the same time. You only have to redirect ARP request to the machine which need to know the list of connected devices.

If your switch is manageable, it should have it's own ARP table and you will be able to read it.

Not the answer you're looking for? Browse other questions tagged or ask your own question.