Nmap can scan and sometimes successfully detect the running OS in the remote host. However, can nmap scan routers and switches? Most of them use an embedded system.
Don't forget other network protocols, routing protocols, Cisco Discovery Protocol, SNMP, etc.., there's a ton of information on these types of devices and "Yes" you definitely can identify them and their OS versions using nmap. Don't forget about nmap's scripting options either, you could write a .NSE just for this if you wanted (there may already be one for that matter). SNMP and CDP will give you the exact OS version information if you have access to them. Even SSL certificates on these devices may leak versioning information. Hope this helps.
Yes, provided the devices are reachable on the network they can be scanned.
The accuracy of the results (e.g. fingerprinting) is dependant on the platform, software version, running services and configuration.
$ nmap -A -T4 10.1.1.1 Nmap scan report for 10.1.1.1 Host is up (0.020s latency). Not shown: 999 closed ports PORT STATE SERVICE VERSION 23/tcp open telnet Cisco router Service Info: OS: IOS; Device: router Service detection performed. Please report any incorrect results at http://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 2.21 seconds
This command helped me achive the same
$ nmap -O -v 172.22.253.1
c:\nmap>nmap -O -v 172.22.253.1 Starting Nmap 7.70 ( https://nmap.org ) at 2019-10-18 11:51 W. Europe Daylight T ime Initiating Ping Scan at 11:51 Scanning 172.22.253.1 [4 ports] Completed Ping Scan at 11:51, 1.77s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 11:51 Completed Parallel DNS resolution of 1 host. at 11:51, 0.01s elapsed Initiating SYN Stealth Scan at 11:51 Scanning 172.22.253.1 [1000 ports] Discovered open port 1720/tcp on 172.22.253.1 Discovered open port 22/tcp on 172.22.253.1 Increasing send delay for 172.22.253.1 from 0 to 5 due to 40 out of 132 dropped probes since last increase. Completed SYN Stealth Scan at 11:51, 12.17s elapsed (1000 total ports) Initiating OS detection (try #1) against 172.22.253.1 Nmap scan report for 172.22.253.1 Host is up (0.00s latency). Not shown: 992 closed ports PORT STATE SERVICE 22/tcp open ssh 25/tcp filtered smtp 1720/tcp open h323q931 6666/tcp filtered irc 6667/tcp filtered irc 6668/tcp filtered irc 6669/tcp filtered irc 7000/tcp filtered afs3-fileserver Device type: router Running: Cisco IOS 12.X OS CPE: cpe:/h:cisco:2811_router cpe:/o:cisco:ios:12.x OS details: Cisco 2811 router (IOS 12.X) TCP Sequence Prediction: Difficulty=262 (Good luck!) IP ID Sequence Generation: Randomized Read data files from: c:\nmap OS detection performed. Please report any incorrect results at https://nmap.org/ submit/ . Nmap done: 1 IP address (1 host up) scanned in 32.82 seconds Raw packets sent: 1153 (52.522KB) | Rcvd: 1014 (40.914KB)
I'm not so sure you can get switches infos the same way you get them from routers. Switches (layer 2) are not routers (layer 3), but routers need to be also switches (layer 2) to route the traffic; They intercept and manage the packet to be vehicolated trough the net, while switches don't manipulate traffic; They only switch between MAC addresses of different NICs. Every time you get a port opened or an OS fingerprinting, that's because all the traffic sent and received passes through layer 3. If you put a switch between two nodes and sniff MAC addresses, you'll always see only two MACs: source and destination. You will never see the MAC address of the switch port the two nodes are connected to, because the switch is a transparent device.