Network Discovery How do we find out what is out there to be managed? - Inventory Management - Configuration Management - Building a Map 1) Personal Knowledge - interview people, talk to others who use parts of the network 2) Passive Observation of Traffic - watch what happens - deduce roles of different hosts based on IP addresses, port numbers, traffic counts, etc - local network config, ARP and routing tables ifconfig -a, arp -a and netstat -nr 3) Active Probing - Use what we learned above to bootstrap active discovery, such as what addresses to start with. a) ping - ICMP, Internet Control Message Protocol echo request, echo reply if success, IP is up and running and a layer 3 path exists if no response, it could be anything causing the problem b) traceroute - use ICMP TTL expired, gives you the layer 3 (router) path to the destination but not the return path c) port scanning - e.g. Nmap d) web crawling - e.g. wget e) DNS crawling - e.g. host, dig, nslookup, zone transfers f) SNMP queries - MIB-II and beyond see demos at simpleweb.org Remember, there is a fine line between network discovery for good and network discovery for evil!