3

I'm looking to scan a network with multiple subnets. I'm looking for a way to shorten this to one command rather than entering each subnet. So let's say I'm try to scan 192.168.1.xx, 192.168.2.xx and so on until 192.168.10.xx. with a specified port. Is there a better way to do this or can I only scan one at a time?

2 Answers 2

11

Let's see the first five lines of the help:

Nmap 7.92 ( https://nmap.org )
Usage: nmap [Scan Type(s)] [Options] {target specification}
TARGET SPECIFICATION:
  Can pass hostnames, IP addresses, networks, etc.
  Ex: scanme.nmap.org, microsoft.com/24, 192.168.0.1; 10.0.0-255.1-254

The notation from the last example would give you a short option:

nmap -p22 192.168.1-10.0-255

Or you could use CIDR notation:

nmap -p22 192.168.1.0/24 192.168.2.0/23 192.168.4.0/22 192.168.8.0/23 192.168.10.0/24
1
  • To avoid typing a ridiculously long command, you can use the -iL parameter to specify a list of IP ranges. Apr 21 at 21:24
2

Create a list of the subnets in a text file with the following format:

10.0.2.0/24
10.0.3.0/24
10.0.4.0/24
10.10.0.0/16

Now, when you run your nmap command, use the -iL parameter:

nmap -p 22 -iL subnets.txt if your text file was saved as subnets.txt

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.