scaning the local network with arping/sh script

[c0ldbyte]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Mon, 25 Apr 2005, Murat Balaban wrote:

>
> Hi,
>
> Did you check http://www.enderunix.org/knowlan/ ?
>
> What is Knowlan?
>
> Knowlan is ARP protocol based Local Area Network IP and MAC Adress Extractor. Knowlan uses libpcap and libnet libraries for to be simple to handle and to have a simple code for any interestor to deal with the code. To describe knowlan overally, Knowlan, sends ARP REQUEST packets to the LAN, and at the same time, It recieves ARP REPLY packets from the up machines. So, It prints out IP and MAC addresses of online machines
>
>
> On Mon, Apr 25, 2005 at 07:41:30AM +0300, Abu Khaled wrote:
>> On 4/24/05, Alex Soares de Moura <alex at rnp.br> wrote:
>>> Abu Khaled wrote:
>>>
>>>> Greetings...
>>>>
>>>> I don't know much about scripting but i tried to write one to scan my
>>>> local network using the net/arping port.
>>>> here is the script:
>>>> <sciprt start>
>>>> #!/bin/sh
>>>> IP=1
>>>> while [ $IP -le 20 ]
>>>> do
>>>> echo -e ".\c"
>>>>   if ( arping -c 1 -q -i rl1 10.0.0.$IP ) then
>>>>      echo -e "\n10.0.0.$IP Online"
>>>>   fi
>>>> IP=$(( $IP +1 ))
>>>> done
>>>> echo -e "\n"
>>>> <script end>
>>>>
>>>> The script runs and reports OK but it is very slow and takes a lot of
>>>> time to scan a large network. Does anyone have an idea on how to
>>>> improve it or provide an alternate way to do it?
>>>>
>>>> PS: I used the arpscan port in the past but it is reported as broken:
>>>> Unfetchable.
>>>>      I'm running FreeBSD 5.4 Stable.
>>>>
>>>>
>>> Have you tried the ettercap tool? It's in the ports:
>>> /usr/ports/net-mgmt/ettercap
>>>
>>> Best regards,
>>>
>>> Alex
>>>
>>>
>>
>> Thanks Alex. Ettercap is a nice tool but I don't run X on my Gateway/Servers.
>> I was looking for a port/package that runs from console. Seems that I
>> forgot to mention that in my post.
>>
>> Thank again and sorry for the incomplete information.
>>
>> --
>> Kind regards
>> Abu Khaled

Ettercap-NG or even previous versions of Ettercap dont need a "X11"
environment to run in. Dont forget that on your said Gateway machines
you can specify in your (/etc/make.conf) the WITHOUT_X11=YES variable
and some but not including all will be built without "X11" support
and one of the ports includes ettercap. Ettercap also has the following
variables that you can set upon build time.

WITHOUT_GTK=yes         builds without GTK2+ GUI
WITHOUT_ICONV=yes       builds without support for UTF-8
WITHOUT_PCRE=yes        builds without support for perl regexps in filters
WITHOUT_PLUGINS=yes     builds without ettercap plugins
WITHOUT_SSL=yes         builds without support for SSH1 and SSL decryption

I would suggest the following as a build if you wanted to use this.

( make WITHOUT_GTK=yes install clean )

or maybe even a make package.

Best of luck,
 	--c0ldbyte

- -- 
( When in doubt, use brute force. -- Ken Thompson 1998 )
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (FreeBSD)
Comment: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xF7DF979F
Comment: Fingerprint = D1DC 0AA4 1C4E EAD4 24EB  7E77 B261 50BA F7DF 979F

iD8DBQFCbNrRsmFQuvffl58RAu0+AJ4iYvSCDn2nfsGsoQGnfrO7MWfKIgCaA2NL
zuP5W6Pm//flJSdvtr+jHYg=
=1Wyu
-----END PGP SIGNATURE-----