Scanning your network with nmap.

[dos2unix]

I have a lot of stuff on my home network. Sometimes it's difficult to keep track on it all.

Every now and then I like to run a scan and see what's on my network. What ports are they using? Who made that device?
Now this can also be used as a low-level hacker tool, but I'm not too worried about it, since you have to already be on the network
you are scanning in order for this to work.

Warning:** - Only try this at home. Don't do this at your work unless you are on the network team.
Network admins usually don't like people scanning their networks, and often will disable the port you are on, effectively
keeping you off the network. In fact, some routers and switches are set up to do this automatically.

nmap -sT 10.0.0.0/24

Obviously, you should change that to whatever subnet you are on.

nmap -sT 192.168.0.0/24

Depending on how many devices are on your subnet, this can return quite a list.

A lot of hackers use nmap to see what IPs are on a subnet, and then what ports are exposed to the network on that subnet.
This will show the IP addresses, the MAC addresses, which ports are running on that device, and usually the manufacturer of that device.

In some cases, it will be obvious if the manufacturer is Apple or Dell.
In other cases, it's a little harder to tell which device is which, for example the manufacturer might show up as Atheros, Broadcom, or Intel.

Then you have to know what network chipset is in your computer.

This also works for cell phones and printers, my devices show up as Samsung and Brother.

But it's a handy tool to know how many, and what devices are currently on your network.

There are other things nmap will scan also, perhaps if there is enough interest, I will talk about those.

 

[MikeRocor]

I have a little script called "whoo" that scans, by default, the current local network (using <IP_ADDRESS>/24 ) to tell me what hosts are up (not "who" is logged in). I can give it a different starting point to scan a different subnet. So if I'm on a wired device on my network (192.168.1.x), whoo will show what hosts are up on the wired network while whoo 10.0.0.1 will show what hosts are up on the wireless network. If I'm on a wireless device (10.0.0.x) on my network, whoo shows wireless hosts that are up and whoo 192.168.1.1 shows what wired devices are up (assuming I remembered to set up the route to the wired lan subnet)

While my wired devices are set ip to also report their hostnames, I haven't quite figured out how to do that with wireless setup - it looks like it should work, but it doesn't actually work.

Edit: Internally, it uses nmap

 

[CaffeineAddict]

A lot of hackers use nmap to see what IPs are on a subnet, and then what ports are exposed to the network on that subnet.
This will show the IP addresses, the MAC addresses, which ports are running on that device, and usually the manufacturer of that device.

To add, nmap also lets you scan for which service is behind the port.
Depending on vulnerabilities of the service it may be exploited.