4

Is it possible with Nmap (or other tool) to scan a range of private IPs (let's say 10.0.0.0/8) but being outside any private network (using those IPs) ?

  • 1
    Sure you can. Connect via VPN to the location where you want to scan, and scan away. The reason for private addresses, is just that, to maintain a separate, and private network. – munkeyoto Mar 28 '16 at 19:51
  • @munkeyoto thank you, but how come, when i'm not connected to my network if i do: nmap 10.0.0.0/8, it only scans 512 hosts ? – aurelien75000 Mar 28 '16 at 20:04
  • Think of it this way. How do you grab something from your fridge while you're outside your house? You can't stick your hands through walls. You have to actually get up and walk into the kitchen. You cannot penetrate the "wall" that is NAT without actually having a NATed IP address. – Ohnana Mar 28 '16 at 20:43
  • 1
    Private IPs are not unique; which of the umpteen 10.0.0.0/8 networks on the planet do you wish to scan? – Phil Lello Mar 28 '16 at 20:51
  • 1
    I thought your previous question about nmap addressed the issue of scanning only 512 IPs. – schroeder Mar 28 '16 at 22:06
4

Not using a VPN or some other way to be connected as if you were local the answer is no but not because of a limitation in Nmap or any similar tool. The primary reason this won't work is because the IP range you are talking about, 10.0.0.0/8, is considered a private internet address range per RFC1918 which is not supposed to be routed over the public Internet. In almost all cases this means it will likely be Null-Routed by all the Internet Service Providers routing traffic between your location and the potential target IP's and you will get "no route to host" warnings at best.

https://tools.ietf.org/html/rfc1918

That said there are many situations where networks are misconfigured and some connectivity leaks out a very short distance. I've seen this on small providers of metropolitan Ethernet networks and also with misconfigured MPLS networks but these were technically local connections to where I was and not something that could have been reached over the global Internet at large.

| improve this answer | |
  • So, if i'm physically close to the private network, but not connected on it i can't scan it ? – aurelien75000 Mar 28 '16 at 21:53
  • Correct, you need to be connected to it on an IP-level to be able to scan it properly otherwise you're just testing the external network connected to it and the NAT rules allowed. Note: There is an exception to this, if you work for Company A and are on Company A's public network depending on the configuration of the network there are scenarios where you could connect to Company A's private network via internal routing within the Company A network. This would not be the norm but it could happen. Again I assume your question refers to being outside of Company A completely. – Trey Blalock Mar 28 '16 at 22:15
  • thank you, last question though, can i ping a private IP if i'm not on the same network and if the machine if connected (to its network) ? – aurelien75000 Mar 28 '16 at 22:20
  • 1
    Not directly but if there is a NAT rule allowing that system to be accessed from the Internet you could ping the "External IP address" and your ping would be NAT'ed and in turn make it to the internal server if Ping is allowed in bound. If there is no NAT rule for that server then no. – Trey Blalock Mar 28 '16 at 22:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.