Best way to determine if IPs in a subnet are up or down in Linux

Question

I have a simple method that I am using on four subnets to determine which registered IPs are actually up and active, and which ones can be removed.

Initially, I iterate through the list of domain names with this command:

sudo nmap -sS -O -v oN $filename $name

$filename is my output file for that IP and $name is the domain name that was read in.

From that command, for all IPs that reported 'host down', I run this command:

sudo nmap -Pn -sS -O -v -oN $filename $name

Note that the only difference here is that I am now assuming the host is up, just to see what comes back.

In all the cases I've seen thus far, however, all the ports that are scanned are filtered, and since the host is assumed to be up, I don't have a way to verify that it actually is up after this second scan is run.

Any other ideas?

"filtered" is what you will get if the host is actually down. Why not use ping to see if a host is up? — user253751, Oct 31 '16 at 23:36

score 3 · Accepted Answer · answered Sep 22 '16 at 19:30

1) Hopefully you don't need to passively gather that information.

You could listen for traffic with something like tcpdump, wireshark, firewall logging, etc... over time gathering information as systems transmit data or otherwise do their thing.

2) Switches

If you have neat switches, they might tell you a bunch.

3) ARP

Firewalled systems may still respond to ARP requests, so you can get them to show themselves. You really only need to know the IP is being used right? Not if it will respond to anything.

Perhaps this would work...

# arping -I enp0s31f6 192.168.1.1
ARPING 192.168.1.1 from 192.168.1.122 enp0s31f6
Unicast reply from 192.168.1.1 [14:CC:20:D4:F7:8E]  2.143ms
Unicast reply from 192.168.1.1 [14:CC:20:D4:F7:8E]  2.011ms
Unicast reply from 192.168.1.1 [14:CC:20:D4:F7:8E]  2.006ms
Unicast reply from 192.168.1.1 [14:CC:20:D4:F7:8E]  2.090ms
^CSent 4 probes (1 broadcast(s))
Received 4 response(s)

Or more in combination by using nmap or something to attempt a connection, then logging the ARP reply at the same time with wireshark, etc....

Best for last, nmap has Arp Mode. I've never tried it.

https://nmap.org/book/nping-man-arp-mode.html

4) DHCP

If any addresses are DHCP addresses, the DHCP leases will show when they were last renewed.

I didn't think about ARP. Thanks! – UnworthyToast Sep 22 '16 at 20:29 — UnworthyToast, Sep 22 '16 at 20:29

score 0 · Answer 2 · answered Sep 23 '16 at 17:05

If Nmap is reporting "host down" then you can assume with a high probability that there is no host using that IP address. The probes that were chosen for the default host discovery will get a response from the vast majority of networked systems, and is even better for directly-connected (same network link) systems because of the use of ARP probes, which are a prerequisite for IP communication over Ethernet-style links. That is to say, if it won't respond to an ARP request, it cannot have an IP address.

You say, "since the host is assumed to be up, I don't have a way to verify that it actually is up," but the truth is, it is probably not up. In fact, if all ports are filtered, it is nearly conclusively down. For all intents and purposes, nothing is willing to communicate using that IP address, which is all that "down" means.

Lastly, your scans will be much quicker if you allow Nmap to scan hosts in parallel by providing multiple target specifications on the command line or via the -iL input file option instead of using a shell loop to scan each one individually. Even if you are using backgrounding (&) to launch parallel nmap processes, you cannot beat the speed of Nmap's own adaptive parallelism.

Best way to determine if IPs in a subnet are up or down in Linux

2 Answers2