RE: [BULK] Re: need help with ping of list by name

["Norris Carden" <ncarden () ascendfcu org>]

Brandon,

What I am trying to do is take a very long list of system names
enumerated from Active Directory and identify systems that do not exist.
All I have is computer names. I was hoping Nmap would be able to help me
with this.

Here are my assumptions:

A system that exists will respond to a ping. I can easily assume these
exist.
A system that does not respond to a ping, but has a DNS entry might
still exist, but is currently powered down.
A system that has no DNS entry either never existed or has been powered
off long enough for their DDNS entry to expire. These are the systems I
am trying to identify.

I can get Nmap to report a status on the first two conditions, but
nothing on the third. If there was a way for it to report on all three,
I could easily sort and find all system names with that third condition.
Then any further testing for confirmation could be done on a much
smaller list of systems.

Norris Carden

-----Original Message-----
From: Brandon Enright [mailto:bmenrigh () ucsd edu] 
Sent: Friday, April 16, 2010 1:56 PM
To: Norris Carden
Cc: nmap-dev () insecure org; bmenrigh () ucsd edu
Subject: [BULK] Re: need help with ping of list by name
Importance: Low

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Fri, 16 Apr 2010 11:03:28 -0500
"Norris Carden" <ncarden () ascendfcu org> wrote:

> I need help figuring out how to get Nmap to do a ping of a list of
> computers and tell me which hosts are up and which are not ...
> including the hosts that do not have DNS entries. Here's my scenario:
>
> I exported a list of computers from AD, which I know includes
> computers that no longer exist. I need to determine which ones are
> alive and which are not. So I tried this:
>
> nmap -sP -iL computers.txt -oA ComputersPing
>
> The output is great for telling me what is alive, and even systems
> that have a DNS entry but are not not up. What it does not do is tell
> anything about a system that does not have a DNS entry. Because of the
> use of DDNS, the retired systems are no longer in DNS.
>
> Is it possible to get Nmap to output details about the entries in the
> list that are not in DNS?
>
> Norris Carden

I might be missing something here, but what details are you looking for
for "retired systems no longer in DNS"? If you have a name for a box
but it isn't registered in DNS but the machine is up, you need to get
an IP by other means.

Can you nbtscan things like 10.1.180.0/24 or 216.76.0.0/14?

Otherwise you should consider exporting ARP tables from your routers.

Brandon

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.14 (GNU/Linux)

iEYEARECAAYFAkvIst8ACgkQqaGPzAsl94JK1ACfYF8D9L1naIyLHn7LXDXlAKlg
y/0AoIQLEuEbPqqdEWGRZBvYSPq2Mnzn
=UHEv
-----END PGP SIGNATURE-----



_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/