Re: how to get a network's IPs?

From: Floyd L. Davidson (floyd_at_barrow.com)
Date: 04/30/05


Date: Fri, 29 Apr 2005 15:12:00 -0800


"TW" <tuxwins@yahoo.com> wrote:
>Actually, I apologize for not being clear about a number of things
>here:

Ahhh... so what they actually had going was a game to see who
could hack into it; and those who couldn't, didn't waste
any bandwidth!

Well...

>1) it was *not* DHCP (even I can connect to that...). no, the network
>had fixed IPs to be taken from a limited, if large, numbers of IPs
>available to the building.

Okay, you aren't as green and wet as I was assuming then... ;-)

>2) it was not "illegal" to find them. Only a somewhat ill-mannered
>since these IPs were *not* given to the installfest participants. I
>should note that the issue here was solely bandwith and that *nobody*
>tried anything funny there (not with plenty of very savvy people -
>unlike myself - looking over their shoulders).

That is what I was assuming right from the start. They don't
have "install fests" at university facilities with network
connections on every table without having all the necessary
ducks lined up.

>They did use some kind of sniffer however. I have no idea which one
>or, and that was my original question, I still do not know how one can
>sniff a (non-DHCPed) network without knowing with what IP to configure
>one's card.

Oh, goodness... there are so many ways to do that it isn't
funny. You listed a couple to start with, and they would indeed
have indicated something, or they would *if* there is already at
least some kind of traffic on the LAN. But they won't give you a
usable address! Instead you get a hint as to which subnets
appear to be in use, which does suggest that you can try
addresses in those ranges. Of couse if someone got really into
this as a game, they would set up the entire LAN with *only*
host routes, and have not one single pre-existing host on a
subnet that could be routed! No traffic sniffer would detect
the right subnet for the IP range that could be used...

I don't know if this would actually work, but if faced with such
a task...

Try something fairly simple? First, the IP addresses will
almost certainly be in the non-routable private network space,
like 10.n.n.n and 192.168.n.n. So pick an IP in each of those,
configure the network interface for it, and send a ping to
255.255.255.255 to see what kind of responses you get. Each
ping will be answered by every interface on the LAN that can
route to that subnet. So if you are sitting on a usable subnet,
you'll know it.

That could easily be manually tested on three or four major
blocks of IP addresses, and if nothing popped up it would be
relatively easy to write a short shell script that would send a
broadcast ping on each and every typical subnet within each
block of IP addresses.

I suspect that would find a suitable IP address within minutes.

But of course, anyone sneaky enough to use host routing on
all the existing hosts... might also use only host routing
for the entire "block" of allowed IP addresses too! So they
might be odd addresses, none of which is contiguous with any
of the others.

That means you'd have to re-write the script to ping *every*
address in those blocks... It might take awhile, but you'd
find one eventually.

(And now you know what to do if *you* are the one designing
the game...)

-- 
Floyd L. Davidson           <http://web.newsguy.com/floyd_davidson>
Ukpeagvik (Barrow, Alaska)                         floyd@barrow.com


Relevant Pages

  • Re: One computer cant see the other.
    ... I'm not sure I'm doing this right Steve, but on the command prompt at my host ... command prompt on my host machine and my client machine when I ping the host. ... network of two computers. ... The most likely problem is that a firewall (Norton, McAfee, ZoneAlarm, ...
    (microsoft.public.windowsxp.network_web)
  • Re: TCPIP - Ping tool
    ... Strangely enough the answer was under your nose all along, namely PING. ... If your "internal network" corresponds to a Local Area Network (LAN), ... assume the subnet address for your LAN is 192.168.10.0 and the subnet mask ...
    (bit.listserv.ibm-main)
  • Re: Intermittent Routing Problem
    ... All of this is happening on our local LAN. ... the network to a 192.168.1.0/24 network. ... When I move it to the other subnet ... can you ping it from the internet? ...
    (comp.unix.sco.misc)
  • Re: simple networking question
    ... Can the hardware PC's ping each other? ... company so why can't I network two pcs together?? ... I'm guessing you can ping by IP but not host name. ... virtualization). ...
    (microsoft.public.windows.server.general)
  • Re: Web Site Mystery
    ... there is a pointer to the ip address of the host ... When I ping any other address it does resolve to an ip address but returns ... www.europacrown.com don't work from our corporate network. ... promoted our a SQL server to act as a domain controller and active ...
    (microsoft.public.windows.server.general)