[ILUG] network discovery...

[Paul Kelly]

Scott Wunsch wrote:
> Active approach:  Walk through the entire subnet firing off ARP requests
> and watching for responses.  It's still a lot of work, but it's slightly
> less network traffic than using ping (which would have to do the ARP
> requests anyway, after all).

An approach which, on our current estimates, will take several days for
10.0.0.0/8

> Passive approach:  Sit there on the network, and watch all the ARP traffic.
> After watching for a while, you'll have the IP address of any machine that
> ever bothers to talk on the network. Of course, this could take a while
> before you would be very sure of getting all the machines.

Ooooh. That's a nice idea. I like it. Would need to skulk around for at
least 15 minutes for any reasonable results, but I think that's within
the bounds of sanity. Gives us something to do while running an nmap -O
against machines found by Other Means.

Paul.