How to scan IP addresses details on your network using NMAP

 

You know using Linux is a kind fun, think about a requirement and you can see a wide number opensource tools gives you wings to your idea, no hurdles just go with your goal, they all will support you..

I would like to share you, what made me search internet and write this blog post.

So within my Lab environment, it's a very frequent task to configure, update IP configuration of other virtual machines, so to tackle this task, I have already written an Ansible Role, which basically configures the IP address for the host which has existing dhcp address assigned to it.

Now still there are some information I need to provide ansible before I proceed to run the playbook and the information it needs is, I need to manually look for free IPs in my current network.

So I was curious how to scan my network for used and free IP addresses, thus I surfed the internet and found, my friendly network troubleshooting tool NMAP gives the insight about it.

Let's see what command can be used to find those details.

Using below one lines to search for used IPs within your network.

$ nmap -sP 192.168.29.0/24

Output

Starting Nmap 6.40 ( http://nmap.org ) at 2022-06-16 17:10 IST
Nmap scan report for 192.168.29.1
Host is up (0.0078s latency).
Nmap scan report for 192.168.29.9
Host is up (0.0050s latency).
Nmap scan report for 192.168.29.21
Host is up (0.0043s latency).
Nmap scan report for 192.168.29.30
Host is up (0.0015s latency).
Nmap done: 256 IP addresses (4 hosts up) scanned in 2.59 seconds

Now let's scan again the same network and look for the listening ports along with the host ip

$ sudo nmap -sT 192.168.29.0/24

Output

Starting Nmap 6.40 ( http://nmap.org ) at 2022-06-16 17:17 IST
Nmap scan report for 192.168.29.1
Host is up (0.0061s latency).
Not shown: 992 filtered ports
PORT     STATE  SERVICE
80/tcp   open   http
443/tcp  open   https
1900/tcp open   upnp
2869/tcp closed icslap
7443/tcp open   oracleas-https
8080/tcp open   http-proxy
8200/tcp closed trivnet1
8443/tcp open   https-alt
MAC Address: AA:HA:IC:PF:P3:C1 (Unknown)

Nmap scan report for 192.168.29.9
Host is up (0.0083s latency).
Not shown: 998 closed ports
PORT    STATE SERVICE
80/tcp  open  http
554/tcp open  rtsp
MAC Address: 14:07:o8:g5:7E:99 (Private)

Nmap scan report for 192.168.29.21
Host is up (0.0051s latency).
Not shown: 998 closed ports
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: 08:76:20:00:75:D5 (Cadmus Computer Systems)

Nmap scan report for 192.168.29.25
Host is up (0.0057s latency).
Not shown: 999 filtered ports
PORT    STATE SERVICE
135/tcp open  msrpc
MAC Address: F0:76:30:60:8E:21 (Unknown)

Nmap scan report for 192.168.29.30
Host is up (0.0018s latency).
Not shown: 997 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
8000/tcp open  http-alt
8080/tcp open  http-proxy

Nmap done: 256 IP addresses (5 hosts up) scanned in 7.84 seconds

If you need additional details like Host OS details and some more, then run the scan again with below command

$ sudo nmap -sT -O 192.168.29.0/24

Output

Nmap scan report for 192.168.29.30
Host is up (0.00026s latency).
Not shown: 997 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
8000/tcp open  http-alt
8080/tcp open  http-proxy
Device type: general purpose
Running: Linux 3.X
OS CPE: cpe:/o:linux:linux_kernel:3
OS details: Linux 3.7 - 3.9
Network Distance: 0 hops

Hope this post will help you in some sort !