6

I need to scan several /16 and a /8 subnet to see what hosts are up and additionally, if any services are running on a select few ports. I've tried various tools such as angry IP scanner, Nmap, advanced IP scanner. But they all crash out after a while and none of them complete the scans as required.

Whats the best way to identify a servers and services in a large subnet?

Improve this question
2
  • does your targeted enviroment employs ids or ips if such there is a chance depending upn configuring ips can be providing active response by sending a crafted malformed response.
    – Saladin
    Commented Mar 18, 2013 at 18:06
  • I would use dnmap to do this, but only after careful analysis using bnat_suite and some selective nmap point-solution analysis. See my question and answer here -- security.stackexchange.com/a/82529/140 -- with an additional note that many other answers to your question and mine were inaccurate. For example, nmap requires very certain flag combinations. Using -PS or the timeout flags may cause massive errors and omissions.
    – atdre
    Commented Apr 9, 2015 at 19:15

5 Answers 5

Reset to default
11

Unicornscan is a tool known for high-speed scanning of large net blocks (e.g. last I observed was sustained 60+mbps internet-based scans).

Nmap in the past definitely had memory consumption issues w/large scans, but I haven't seen those issues in the 5.x/6.x versions when performing 65k ports scans over several /16s.

The memory problems I run into are typically due to ip_conntrack and below are a couple of recommended links to tweak kernel/ip_conntrack settings that can help nmap:

Improve this answer
5
  • 1
    looks like a simple comprehensive scanner but void of service detection?
    – Saladin
    Commented Mar 18, 2013 at 18:12
  • 1
    Looks good to me. I haven't heard of unicornscan before... I'll try this out and if it all works out I'll report back!
    – NULLZ
    Commented Mar 19, 2013 at 2:11
  • Thanks for the recommendation. It looks like a nice alternative to nmap for certain scenarios.
    – user10211
    Commented Mar 19, 2013 at 2:24
  • @asadz - It's not void of service detection at all, don't know where you're getting that from. The description clearly states Unicornscan has Asynchronous stateless TCP banner grabbing abilities, protocol specific UDP Scanning, and Active and Passive remote OS, application, and component identification by analyzing responses. What more would you want in the service detection sense?
    – TildalWave
    Commented Mar 19, 2013 at 2:28
  • signatures are big problems this is where service detection happens is it tightly controlled , tested and verified. This is where assurance comes in
    – Saladin
    Commented Mar 19, 2013 at 4:17
5

Well as @TerryChia says I'm surprised that nmap is causing problems for you, I don't think I've ever seen it crash..

However that said, assuming it is, there's a couple of approaches you can take which may help.

  1. Manually break up the range. Create a text file with smaller ranges and then automate the process of kicking a scan of each range off one at a time. Once you've got all the results you can aggregate them together to give an overall picture. An example of a script you can use to parse a directory full of nmap results is here
  2. Having not seen the switches you're using it's hard to provide exact advice here, but if you're not already I'd be using -sP and a range of ports (specified via -PS or -PU) to establish a list of "up hosts" which you can then scan, if you need more information.
Improve this answer
3

Have you investigated the reason for the tools you use crashing after a while? I have used nmap to scan rather large networks without any issues whatsoever.

In fact, the nmap tool has been used to port scan large portions of the internet without any problems as seen in this defcon presentation.

You might want to experiment with different nmap flags or try scanning with a different machine to test out the different possibilities why your scans might be failing.

If you really cannot scan the entire subnet at one go, split the task into several scans. It should be easy enough to do...

Improve this answer
3
  • Hmm, thats interesting. I've -always- had issues with nmap and other scanners on large networks. I've raised the issue with nmap devs to no avail and i've tried multiple different settings. I've also tried different PC's and OS's and still no luck... Not sure whats going wrong if that's the case.
    – NULLZ
    Commented Mar 18, 2013 at 13:10
  • 1
    @D3C4FF Well, you could split the scan into several smaller ones. Also has the advantage of allowing you to run multiple scans at one go, speeding up the process overall. Should be easy enough to collate the results especially using the xml format. nmap has still been the most reliable network scanner for me.
    – user10211
    Commented Mar 18, 2013 at 13:14
  • Yeah, i've been breaking it up into /20's and so far no issue.
    – NULLZ
    Commented Mar 19, 2013 at 2:12
3

I believe nmap is suitable for scanning large number of IPs. I myself have scanned only /16 subnets with nmap but HD Moore in 2012 scanned the entire Internet through nmap. All you need is play with the command line arguments of nmap. The ones HD used for scanning the Internet were:

  1. --min-rate=5000 -m 256 --min-host-group=50000 -PS -p
  2. Match --min-rtt-timeout to --max-rtt-timeout

So I guess nmap can be quite effective. If it is capable of scanning the entire IP range over Internet, it won't have any problem fulfilling your requirements.

Improve this answer
3

One interesting tool for this purpose has surface recently. It is called massscan and the code for it can be found in this GitHub repository.

A quote from the README.

This is the fastest Internet port scanner. It can scan the entire Internet in under 6 minutes, transmitting 10 million packets per second.

It produces results similar to nmap, the most famous port scanner. Internally, it operates more like scanrand, unicornscan, and ZMap, using asynchronous transmission. The major difference is that it's faster than these other scanners. In addition, it's more flexible, allowing arbitrary address ranges and port ranges.

This appears to be rather fast but it may be too noisy depending on the environment you are scanning. The README has more information on how the tool works so you might want to investigate this further.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .