While a /24 is nice and manageable, it might not be how the network is broken down. For example, my company uses private space, and subnets some larger offices on a /20 boundary... anyway, the OP asked about subnets, not hosts. I'd say that if his company doesn't know which subnets are in use, they have bigger problems. Foremost is that it is hard to determine "subnets" in use, period. Routers can summarize, or networks may not be advertised outside of a smaller community. That leaves you with gathering IPs, which is prone to fail for all the reasons you've seen. IMO, the best way to gather this IP info if unknown (and if not wanting to involve querying the network infrastructure) is via passive monitoring to see what there is to see, assuming you can get visibility. Netflow or similar can help bunches here. But, if you really want subnets, you can always just query the individual router configuations (not the routing tables) and see what networks their interfaces are configured for. Maybe some sort of SNMP sweep if you can learn the community names.
-ds ----- Original Message ----- From: [EMAIL PROTECTED] To: "Rathbun, Dan" Subject: Re: How to produce a list of target subnets? Date: Mon, 24 Mar 2008 09:28:44 -0400 Here's one approach that may give you a starting point. ----------------------------------------------------------- For each /24 on your network (class C) - Ping sweep/ Nmap sweep / etc.... across current subnet - parse result file (e.g. perl) to build a nessus host file of devices that are up. - Nessus scan of that subnet - next subnet - Problems with this approach - Devices can be turned off by the time they are scanned. - Devices that do not respond on the port/protocol you are using to determine they are up. There are variations on this approach to include the size of the subnet, using a Full NMap and assume hosts are up, etc..... ---------------------------------------------------- Mike Sleeper CISSP, CCSE, CCFS Computer & Information Security ---------------------------------------------------- ************* DISCLAIMER *********************************** The above comments are my own and do not necessarily represent those of my employer or contractor. Any information or advice provided by me shall be given under the "caveat emptor" principal. ***************************************************************** "Rathbun, Dan" <[EMAIL PROTECTED]> Sent by: [EMAIL PROTECTED] 03/24/2008 08:26 AM To <[email protected]> cc Subject How to produce a list of target subnets? Greetings, I am trying to figure out the best way to produce a comprehensive list of subnets on our global network in order to feed it into Nessus. Due to the size of our network and the dynamic nature of it, a new list really ought to be generated at least quarterly…if not monthly. I have tried simply pulling a routing table off one of the core routers, but the resulting file requires too much reformatting to make it fit for this use. There has to be an easier way! I wonder if any of you have found a convenient approach to dealing with this requirement? If so, would you be willing to share your lessons learned? Thanks. Dan Rathbun Information Security Director CISSP, GSLC and GSEC Certified AECOM 515 South Flower Street, 4th Floor Los Angeles, CA 90071-2201 p. 978.930.5656 e. [EMAIL PROTECTED] http://www.linkedin.com/in/drathbun _______________________________________________ Nessus mailing list [email protected] http://mail.nessus.org/mailman/listinfo/nessus _______________________________________________ Nessus mailing list [email protected] http://mail.nessus.org/mailman/listinfo/nessus -- Want an e-mail address like mine? Get a free e-mail account today at www.mail.com!
_______________________________________________ Nessus mailing list [email protected] http://mail.nessus.org/mailman/listinfo/nessus
