Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Nmap can scan and sometimes successfully detect the running OS in the remote host. However, can nmap scan routers and switches? Most of them use an embedded system.

share|improve this question
    
Why not just try it at home? At my place, the TP-LINK wireless router is the noisiest node of the network, leaking all everything about it's firmware :( –  Vorac Sep 4 '13 at 7:46

2 Answers 2

up vote 4 down vote accepted

Don't forget other network protocols, routing protocols, Cisco Discovery Protocol, SNMP, etc.., there's a ton of information on these types of devices and "Yes" you definitely can identify them and their OS versions using nmap. Don't forget about nmap's scripting options either, you could write a .NSE just for this if you wanted (there may already be one for that matter). SNMP and CDP will give you the exact OS version information if you have access to them. Even SSL certificates on these devices may leak versioning information. Hope this helps.

share|improve this answer

Yes, provided the devices are reachable on the network they can be scanned.

The accuracy of the results (e.g. fingerprinting) is dependant on the platform, software version, running services and configuration.

Example:

$ nmap -A -T4 10.1.1.1

Nmap scan report for 10.1.1.1
Host is up (0.020s latency).
Not shown: 999 closed ports
PORT   STATE SERVICE VERSION
23/tcp open  telnet  Cisco router
Service Info: OS: IOS; Device: router

Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 2.21 seconds
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.