7

Nmap can scan and sometimes successfully detect the running OS in the remote host. However, can nmap scan routers and switches? Most of them use an embedded system.

  • Why not just try it at home? At my place, the TP-LINK wireless router is the noisiest node of the network, leaking all everything about it's firmware :( – Vorac Sep 4 '13 at 7:46
7

Don't forget other network protocols, routing protocols, Cisco Discovery Protocol, SNMP, etc.., there's a ton of information on these types of devices and "Yes" you definitely can identify them and their OS versions using nmap. Don't forget about nmap's scripting options either, you could write a .NSE just for this if you wanted (there may already be one for that matter). SNMP and CDP will give you the exact OS version information if you have access to them. Even SSL certificates on these devices may leak versioning information. Hope this helps.

10

Yes, provided the devices are reachable on the network they can be scanned.

The accuracy of the results (e.g. fingerprinting) is dependant on the platform, software version, running services and configuration.

Example:

$ nmap -A -T4 10.1.1.1

Nmap scan report for 10.1.1.1
Host is up (0.020s latency).
Not shown: 999 closed ports
PORT   STATE SERVICE VERSION
23/tcp open  telnet  Cisco router
Service Info: OS: IOS; Device: router

Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 2.21 seconds
2

This command helped me achive the same

$ nmap -O -v 172.22.253.1

Output:

c:\nmap>nmap -O -v 172.22.253.1
Starting Nmap 7.70 ( https://nmap.org ) at 2019-10-18 11:51 W. Europe Daylight T
ime
Initiating Ping Scan at 11:51
Scanning 172.22.253.1 [4 ports]
Completed Ping Scan at 11:51, 1.77s elapsed (1 total hosts)
Initiating Parallel DNS resolution of 1 host. at 11:51
Completed Parallel DNS resolution of 1 host. at 11:51, 0.01s elapsed
Initiating SYN Stealth Scan at 11:51
Scanning 172.22.253.1 [1000 ports]
Discovered open port 1720/tcp on 172.22.253.1
Discovered open port 22/tcp on 172.22.253.1
Increasing send delay for 172.22.253.1 from 0 to 5 due to 40 out of 132 dropped
probes since last increase.
Completed SYN Stealth Scan at 11:51, 12.17s elapsed (1000 total ports)
Initiating OS detection (try #1) against 172.22.253.1
Nmap scan report for 172.22.253.1
Host is up (0.00s latency).
Not shown: 992 closed ports
PORT     STATE    SERVICE
22/tcp   open     ssh
25/tcp   filtered smtp
1720/tcp open     h323q931
6666/tcp filtered irc
6667/tcp filtered irc
6668/tcp filtered irc
6669/tcp filtered irc
7000/tcp filtered afs3-fileserver
Device type: router
Running: Cisco IOS 12.X
OS CPE: cpe:/h:cisco:2811_router cpe:/o:cisco:ios:12.x
OS details: Cisco 2811 router (IOS 12.X)
TCP Sequence Prediction: Difficulty=262 (Good luck!)
IP ID Sequence Generation: Randomized

Read data files from: c:\nmap
OS detection performed. Please report any incorrect results at https://nmap.org/
submit/ .
Nmap done: 1 IP address (1 host up) scanned in 32.82 seconds
           Raw packets sent: 1153 (52.522KB) | Rcvd: 1014 (40.914KB)
0

I'm not so sure you can get switches infos the same way you get them from routers. Switches (layer 2) are not routers (layer 3), but routers need to be also switches (layer 2) to route the traffic; They intercept and manage the packet to be vehicolated trough the net, while switches don't manipulate traffic; They only switch between MAC addresses of different NICs. Every time you get a port opened or an OS fingerprinting, that's because all the traffic sent and received passes through layer 3. If you put a switch between two nodes and sniff MAC addresses, you'll always see only two MACs: source and destination. You will never see the MAC address of the switch port the two nodes are connected to, because the switch is a transparent device.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.