Re: scan based on mac address

[eldraco <eldraco () gmail com>]

Hi sara, hope this helps... once I use this approach...

If the host you want to know the Ip (X host) is in another LAN subnet, but you 
think is still reacheble (and not behind any router) and you know this host 
has a different default GW than yours... something like this.:

X host is in subnet 192.168.4.0 netmask 255.255.255.0, with default GW 
192.168.4.1

And you are in subnet 192.168.1.0 netmask 255.255.255.0 with default GW 
192.168.1.1

Under default conditions this host will be unreacheble to you, and to nmap, 
because it will forward the response to 192.168.4.1 and not to you.

You can try to simply tell nmap to scan that subnet from an IP address in that 
range. The -S parameter. It should work.

I think you don't know in which range it is, but you can try..., in my case 
trying the first ten /24 netwoks worked fine.

Other silly ideas could be: can you spoof of sniff the DHCP server if you use 
one? 
Can you social engenieer your netadmin???

cheers

eldraco

El Friday 08 August 2008 19:10:01 sara fink escribió:
> I tried nmap -sP ip-range and I got the mac address. It didn't solve my
> problem, because most probably it's not on the same segment.
>
> On Fri, Aug 8, 2008 at 11:44 PM, Michael Pattrick
>
> <mpattrick () rhinovirus org>wrote:
> > On Fri, Aug 8, 2008 at 4:08 PM, sara fink <sara.fink () gmail com> wrote:
> > > Besides I tried to run nmap A T4 ip-range. According to nmap example
> > > 15.1
> >
> > in
> >
> > > the output appears the mac address. Unfortunately I didn't receive the
> >
> > mac
> >
> > > address. I know the mac and want to see the relevant ip.
> >
> > That should work as long as you're on the same LAN segment and the
> > host is still up. At least it works for me. I get:
> >
> > Interesting ports on 10.0.0.1:
> > PORT   STATE SERVICE
> > 80/tcp open  http
> > MAC Address: 00:0F:B5:13:E8:BE (Netgear)
> >
> > Cheers,
> > Michael
>
> _______________________________________________
> Sent through the nmap-dev mailing list
> http://cgi.insecure.org/mailman/listinfo/nmap-dev
> Archived at http://SecLists.Org



-- 
Ing. Sebastián García
http://minsky.surfnet.nl:11371/pks/lookup?op=get&search=0x3E42ED27F864EDE6

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org