There are many subnets connected via a router in the same network. I need to find list of all IP address available in each different subnet. I am able to get the list of IP address available in the subnet where I reside.

What is the best way to determine the rest of the subnets in use on my network?


As long as you don't have access to the router there will be no 100% accurate way to detect all the host on these networks.

If you know the network addresses and subnet sizes you can scan these networks using a tool like nmap to detect hosts. If you dont know the addressspace of these other networks but its a private network you can scan all the ranges that are available for private use. These are refered in RFC1918. Doing one or the other will of cause be very noisy and probabbly not accurate if there are strict firewall rules. Such a scan might even not be accurate if you scan your own network because in well segmented networks administrative services are only accessable from the administrative subnet(s).

// It is possible to scan the network you are not residing in as long as the router is routing that packages.

You can also scan every possible ip address with a low TTL value to ensure that its only one or two hops away. This will of cause take a very long time.

You should also consider the possibility that they are using IPv6 for some of their networks which will render scanning useless becaus the possible adressspace is too big.

| improve this answer | |
  • There is a chance that organization might be using public IP address for their internal machines. In these cases, I have to scan the whole Class B and Class C . I am using Nmap -sn for host discovery.But I am not getting any result even after 10 min. Is it possible to scan the network in which you ar not residing? If not how can we scan the network in which we are not residing? – santosh407 Aug 15 '16 at 2:37
  • Shouldn't this Q/A be on SuperUser.SE? – Chris Cirefice Aug 15 '16 at 2:59

You have a private or public network with servers and workstations that are assigned static and dynamic IP addresses (either private or public IPs). You assigned them the static IP addresses due to NAT (Network Address Translation) or for public access, and dynamic IP addresses via the DHCP. Even if you kept a good record of those assigned IPs, there are times when you want to find all IP addresses of networked devices. The following procedure may be used to determine IP addresses of networked devices that are connected to your network.

  1. If you have a web access to your router, you may connect to your router and find the IP addresses of all networked devices. The router displays Static and Dynamic client lists with hostname, IP address and MAC address of the connected devices.

  2. You may also try pinging your network from a computer connected to the network, and lookup an arp table. On your computer, click [Start] -> [Run...] and type "cmd" and [Enter]. Type "ipconfig" to find your network address. The network address is found by performing a logical AND operation on your IP address and the subnet mask. For example, if you IP is and subnet mask is, then the network address is Ping your network using a broadcast address, i.e. "ping". After that, perform "arp -a" to determine all the computing devices connected to the network.

  3. You may also use "netstat -r" command to find an IP address of all network routes. However, if your printer has problem communicating with other network devices, you may not be able to find IP address of the printer using "netstat" command.

There is a one more way too. You can install "netdiscover "on your Windows or Linux. Netdiscover is an active/passive address reconnaissance tool, mainly developed for those wireless networks without DHCP server, when you are wardriving. It can be also used on hub/switched networks.

You can find IP adresses which is on your network device with this command:

netdiscover -i eth0 
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.