The scenario is that you get to plug your laptop into an Ethernet port in some building. You get an IP address (DHCP) and can access the internet.
Right out of the gate you know your IP, gateway, and subnet mask, and you can do an ARP scan to identify hosts on the immediate subnet. What about other internal subnets that you may have access to now that you didn't from the internet?
I am looking for what kinds of tools or technologies you could use to identify these networks.
passively listen for any broadcasted traffic that happens to go to a different subnet (this seems unlikely on a switched network).
check the publicly known ARIN blocks to see if any are reachable internally that were firewalled from an external perspective.
zone transfer may be allowed internally that could identify other servers on other internal subnets.
What did I miss? Of the above strategies, what works best in your experience?