Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I need to scan several /16 and a /8 subnet to see what hosts are up and additionally, if any services are running on a select few ports. I've tried various tools such as angry IP scanner, Nmap, advanced IP scanner. But they all crash out after a while and none of them complete the scans as required.

Whats the best way to identify a servers and services in a large subnet?

share|improve this question
    
does your targeted enviroment employs ids or ips if such there is a chance depending upn configuring ips can be providing active response by sending a crafted malformed response. –  Saladin Mar 18 '13 at 18:06
add comment

5 Answers 5

up vote 10 down vote accepted

Unicornscan is a tool known for high-speed scanning of large net blocks (e.g. last I observed was sustained 60+mbps internet-based scans).

Nmap in the past definitely had memory consumption issues w/large scans, but I haven't seen those issues in the 5.x/6.x versions when performing 65k ports scans over several /16s.

The memory problems I run into are typically due to ip_conntrack and below are a couple of recommended links to tweak kernel/ip_conntrack settings that can help nmap:

share|improve this answer
1  
looks like a simple comprehensive scanner but void of service detection? –  Saladin Mar 18 '13 at 18:12
1  
Looks good to me. I haven't heard of unicornscan before... I'll try this out and if it all works out I'll report back! –  NULLZ Mar 19 '13 at 2:11
    
Thanks for the recommendation. It looks like a nice alternative to nmap for certain scenarios. –  Terry Chia Mar 19 '13 at 2:24
    
@asadz - It's not void of service detection at all, don't know where you're getting that from. The description clearly states Unicornscan has Asynchronous stateless TCP banner grabbing abilities, protocol specific UDP Scanning, and Active and Passive remote OS, application, and component identification by analyzing responses. What more would you want in the service detection sense? –  TildalWave Mar 19 '13 at 2:28
    
signatures are big problems this is where service detection happens is it tightly controlled , tested and verified. This is where assurance comes in –  Saladin Mar 19 '13 at 4:17
add comment

Well as @TerryChia says I'm surprised that nmap is causing problems for you, I don't think I've ever seen it crash..

However that said, assuming it is, there's a couple of approaches you can take which may help.

  1. Manually break up the range. Create a text file with smaller ranges and then automate the process of kicking a scan of each range off one at a time. Once you've got all the results you can aggregate them together to give an overall picture. An example of a script you can use to parse a directory full of nmap results is here
  2. Having not seen the switches you're using it's hard to provide exact advice here, but if you're not already I'd be using -sP and a range of ports (specified via -PS or -PU) to establish a list of "up hosts" which you can then scan, if you need more information.
share|improve this answer
add comment

Have you investigated the reason for the tools you use crashing after a while? I have used nmap to scan rather large networks without any issues whatsoever.

In fact, the nmap tool has been used to port scan large portions of the internet without any problems as seen in this defcon presentation.

You might want to experiment with different nmap flags or try scanning with a different machine to test out the different possibilities why your scans might be failing.

If you really cannot scan the entire subnet at one go, split the task into several scans. It should be easy enough to do...

share|improve this answer
    
Hmm, thats interesting. I've -always- had issues with nmap and other scanners on large networks. I've raised the issue with nmap devs to no avail and i've tried multiple different settings. I've also tried different PC's and OS's and still no luck... Not sure whats going wrong if that's the case. –  NULLZ Mar 18 '13 at 13:10
1  
@D3C4FF Well, you could split the scan into several smaller ones. Also has the advantage of allowing you to run multiple scans at one go, speeding up the process overall. Should be easy enough to collate the results especially using the xml format. nmap has still been the most reliable network scanner for me. –  Terry Chia Mar 18 '13 at 13:14
    
Yeah, i've been breaking it up into /20's and so far no issue. –  NULLZ Mar 19 '13 at 2:12
add comment

I believe nmap is suitable for scanning large number of IPs. I myself have scanned only /16 subnets with nmap but HD Moore in 2012 scanned the entire Internet through nmap. All you need is play with the command line arguments of nmap. The ones HD used for scanning the Internet were:

  1. --min-rate=5000 -m 256 --min-host-group=50000 -PS -p
  2. Match --min-rtt-timeout to --max-rtt-timeout

So I guess nmap can be quite effective. If it is capable of scanning the entire IP range over Internet, it won't have any problem fulfilling your requirements.

share|improve this answer
add comment

One interesting tool for this purpose has surface recently. It is called massscan and the code for it can be found in this GitHub repository.

A quote from the README.

This is the fastest Internet port scanner. It can scan the entire Internet in under 6 minutes, transmitting 10 million packets per second.

It produces results similar to nmap, the most famous port scanner. Internally, it operates more like scanrand, unicornscan, and ZMap, using asynchronous transmission. The major difference is that it's faster than these other scanners. In addition, it's more flexible, allowing arbitrary address ranges and port ranges.

This appears to be rather fast but it may be too noisy depending on the environment you are scanning. The README has more information on how the tool works so you might want to investigate this further.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.