Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I always love staring at those network topology diagrams you see posted up in schools and online. Obviously if you physically setup and configured everything, plotting out servers, subnets, routers etc would be a breeze - But what tools do we have at our disposal to accurately and effectively map an unknown network?

Is it possible to fingerprint every piece of network hardware, every server, firewall, UTM device, proxy and associated ACL's/filters in a way that you could proudly display a detailed map on your bedroom wall?

share|improve this question
Check out nmap. – Terry Chia Nov 2 '12 at 3:36

Typically for the network identification part of a pen test you will need to use a combination of tools.

  • nmap is a good start, showing all devices that have a response, along with what ports respond. The fingerprinting functionality nmap brings is also pretty good. Zenmap provides a cool graphical mapping front end, as @TerryChian commented.
  • p0f does some clever things to get around firewall and router obfuscation of the target OS
  • scapy also has good network discovery functionality
  • etherape - haven't used it but had a quick look as per @symcbean's comment. Worth a look to understand each node's purpose.

You may also want to look at SNMP tools to gain extra info on the hosts you find.

share|improve this answer
zenmap, the nmap gui also has a very cool (although not very useful) feature of actually graphically mapping out a network diagram based on scan results. – Terry Chia Nov 2 '12 at 9:10
Add etherape to your shopping list - it's useful for getting an idea of the roles of each node rather than the services available. – symcbean Nov 2 '12 at 9:21
I'd add Maltego right to the top of that list. Its mapping capabilities are second to none, and it's got a whole host of other features for integrating social network mapping into your investigation stage. – Polynomial Nov 2 '12 at 11:51

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.