# Network Scanning

ARP

# netdiscover -P -r <network> | tee <scanname>-netdiscover

ICMP

# nmap -n -sn -oA <scanname>-icmp <network>

TCP

# masscan <network> -pU:0-65535 --rate 1000 --open-only --output-format <xml|binary|grepable|list|JSON> --output-filename <scanname>-masscan
# nmap -n -p- -T4 -Pn --open -oA <scanname>-nmap <network>
# nmap -n -F -T4 -Pn --open -oA <scanname>-nmap <network>
# zmap --target-port=<port> --bandwidth=10M --seed=1234 --interface=<interface> --probe-module=tcp_synscan --output-file=<scanname>-zmap <network>

UDP

# masscan <network> -p0-65535 --rate 1000 --open-only --output-format <xml|binary|grepable|list|JSON> --output-filename <scanname>-masscan
# nmap -n -p- -T4 -sU -Pn --open -oA <scanname>-nmap <network>
# nmap -n -F -T4 -sU -Pn --open -oA <scanname>-nmap <network>
# zmap --target-port=<port> --bandwidth=10M --seed=1234 --interface=<interface> --probe-module=udp --output-file=<scanname>-zmap <network>

UDP Applications: DNS, IPMI, NETBIOS, NTP, MSDNS, MSSQL, PORTMAP, SIP, SNMPv1, UPNP

# pa=<dns_53.pkt|ipmi_623.pkt|netbios_137.pkt|ntp_123.pkt|mdns_5353.pkt|mssql_1434.pkt|portmap_53.pkt|sip_options.tpl|snmp1_161.pkt|upnp_1900.pkt>
# zmap --target-port=<port> --bandwidth=10M --seed=1234 --interface=<interface> --probe-module=udp --probe-args=$pa --output-file=<scanname>-zmap <network>

# Installing zmap and zgrab from sources

# cd
# mkdir work
# cd work
# git clone https://github.com/zmap/zmap.git
# apt-get install build-essential cmake libgmp3-dev gengetopt libpcap-dev flex byacc libjson-c-dev pkg-config libunistring-dev
# cd zmap
# cmake .
# make -j4
# make install
# cd
# wget https://storage.googleapis.com/golang/go1.5.3.linux-amd64.tar.gz
# tar -C /usr/local -xzf go1.5.3.linux-amd64.tar.gz
# export PATH=$PATH:/usr/local/go/bin
# go version
# export GOPATH=/root/work
# go get github.com/zmap/zgrab
# cd work/src/github.com/zmap/zgrab/
# go build

# Fast tools for ping sweeps

nmap

# apt-get install nmap
# nmap -n -sn -PE -T5 --max-retries 1 --min-parallelism 100 -iL subnets.txt

46432 IP addresses scanned in 72 seconds

# nmap -n -sn -PE -T5 --max-retries 0 --min-parallelism 100 -iL subnets.txt | grep -v Warning

46432 IP addresses scanned in 48 seconds

zmap

# wget https://github.com/zmap/zmap/archive/v1.0.0.tar.gz
# tar xvzf v1.0.0.tar.gz
# cd zmap-1.0.0
zmap-1.0.0# cat INSTALL
zmap-1.0.0# apt-get install libgmp3-dev gengetopt libpcap-dev
zmap-1.0.0# cd src
zmap-1.0.0/src# make
zmap-1.0.0/src# make install
zmap-1.0.0/src# cd
# rm -rf zmap-1.0.0 v1.0.0.tar.gz
# sed -i 's/^black/#black/' /etc/zmap/zmap.conf
# zmap -M icmp_echoscan -B 1G -P 1 -T 100 -w subnets.txt

46432 IP addresses scanned in 72 seconds