請問各位大神
以下是我在cmd下執行nmap -sn -n 192.168.2.*/24
的掃描結果
Starting Nmap 7.80 ( https://nmap.org ) at 2020-05-16 23:29 ¥x¥_?D·CRE?!
Nmap scan report for 192.168.2.1
Host is up (0.0010s latency).
MAC Address: 04:92:26:XX:XX:XX (Asustek Computer)
Nmap scan report for 192.168.2.3
Host is up (0.081s latency).
MAC Address: FC:2A:9C:XX:XX:XX (Apple)
Nmap scan report for 192.168.2.5
Host is up (0.0010s latency).
MAC Address: 90:E6:BA:XX:XX:XX (Asustek Computer)
Nmap scan report for 192.168.2.120
Host is up (0.061s latency).
MAC Address: 44:23:7C:XX:XX:XX (Beijing Xiaomi Mobile Software)
Nmap scan report for 192.168.2.217
Host is up (0.074s latency).
MAC Address: 28:F3:66:XX:XX:XX (Shenzhen Bilian electronic)
Nmap scan report for 192.168.2.2
Host is up.
Nmap done: 256 IP addresses (6 hosts up) scanned in 2.80 seconds
我想把結果裡面的MAC跟IP放在同一行,中間用-做區隔輸出到txt
像這樣
04:92:26:XX:XX:XX-192.168.2.1
FC:2A:9C:XX:XX:XX-192.168.2.3
90:E6:BA:XX:XX:XX-192.168.2.5
44:23:7C:XX:XX:XX-192.168.2.120
當我手上有MAC的時候可以用for /f+findstr取得我要的IP
目前想出來的方法是把掃描結果存成文件,再從文件個別找出MAC跟IP然後寫入同一份檔案
for /f "tokens=3 delims= " %%i in ('find "MAC" scan.txt') do echo %%i>>mac.txt
for /f "tokens=5 delims= " %%j in ('find "192.168." scan.txt') do echo %%j>>ip.txt
set m=0
for /f "delims=" %%a in (mac.txt) do (set /a m+=1
set a!m!=%%a)
set n=0
for /f "delims=" %%b in (ip.txt) do (set /a n+=1
set b!n!=%%b)
for /l %%c in (1,1,%m%) do (
echo !a%%c!-!b%%c!>>arp.txt)
更新一下,這是目前寫出來的東西,最近新增了scan arp table的功能
在scan之前,我會先收集mac,收集方式如下:
set /p psn="Scan Product Serial Number[PSN]:"
set /p cmbmc="Scan CM IPMI Mac Address[CMBMC]:"
set /p n1ipmi="Scan Node1 IPMI Mac Address[N1IPMI]:"
set /p n2ipmi="Scan Node2 IPMI Mac Address[N2IPMI]:"
echo set psn=%psn%>>%psn%.bat
echo set cmbmc=%cmbmc%>>%psn%.bat
echo set n1ipmi=%n1ipmi%>>%psn%.bat
echo set n2ipmi=%n2ipmi%>>%psn%.bat
然後放在SAMBA Server上面,用%PSN%.bat做命名
以下是整個scan的腳本
@echo off
::新增SAMBA存取權限
net use"\\****\" **** /user:****
:chknmap
::檢查是否安裝NMAP
if exist "C:\Program Files (x86)\Nmap\nmap.exe" goto :loop
echo Network Scan Require NMAP.
pause
goto chknmap
:loop
::輸入整機序號 尋找SAMBA上的同名bat
setlocal EnableDelayedExpansion
del scan.txt & del arp.txt & del ip.txt & del mac.txt & del StartChrome.bat
set cmip= & set n1ip= & set n2ip= & set psn=
cls
echo ========================
echo = Find BMC Web =
echo ========================
set /p psn="Scan Product Serial Number : ABCDEF"
if not defined psn goto loop
if not exist \\****\%psn%.bat set psn=ABCDEF%psn%
if not exist \\****\%psn%.bat echo %psn%.bat not found & pause
::支援完整SN與後三碼兩種輸入方式
::找到往下做scan
if exist \\****\%psn%.bat goto arp
::找不到bat則返回
goto loop
:arp
::清理一下畫面
cls
echo ========================
echo = Find BMC Web =
echo ========================
echo Scan Product Serial Number : %psn%
::呼叫變數bat 並將mac存成以-間隔的格式
call \\****\%psn%.bat
set cmbmc=%cmbmc:~0,2%-%cmbmc:~2,2%-%cmbmc:~4,2%-%cmbmc:~6,2%-%cmbmc:~8,2%-%cmbmc:~10,2%
set n1ipmi=%n1ipmi:~0,2%-%n1ipmi:~2,2%-%n1ipmi:~4,2%-%n1ipmi:~6,2%-%n1ipmi:~8,2%-%n1ipmi:~10,2%
set n2ipmi=%n2ipmi:~0,2%-%n2ipmi:~2,2%-%n2ipmi:~4,2%-%n2ipmi:~6,2%-%n2ipmi:~8,2%-%n2ipmi:~10,2%
echo ARP cache Scanning...
::匯出arp table並找出對應IP 存成變數
arp -a>arp.txt
for /f "tokens=1 delims= " %%a in ('find /I "%cmbmc%" arp.txt') do set cmip=%%a
for /f "tokens=1 delims= " %%a in ('find /I "%n1ipmi%" arp.txt') do set n1ip=%%a
for /f "tokens=1 delims= " %%a in ('find /I "%n2ipmi%" arp.txt') do set n2ip=%%a
::檢查變數儲存的是否為IP 不是則刪除變數
echo %cmip% | find "172.16."
if errorlevel 1 set cmip=
echo %n1ip% | find "172.16."
if errorlevel 1 set n1ip=
echo %n2ip% | find "172.16."
if errorlevel 1 set n2ip=
::呼叫變數bat 並將mac存成以:間隔的格式
call \\****\%psn%.bat
set cmbmc=%cmbmc:~0,2%:%cmbmc:~2,2%:%cmbmc:~4,2%:%cmbmc:~6,2%:%cmbmc:~8,2%:%cmbmc:~10,2%
set n1ipmi=%n1ipmi:~0,2%:%n1ipmi:~2,2%:%n1ipmi:~4,2%:%n1ipmi:~6,2%:%n1ipmi:~8,2%:%n1ipmi:~10,2%
set n2ipmi=%n2ipmi:~0,2%:%n2ipmi:~2,2%:%n2ipmi:~4,2%:%n2ipmi:~6,2%:%n2ipmi:~8,2%:%n2ipmi:~10,2%
::用nping檢查此IP是否對應 不是則刪除變數
if defined find /I "%cmbmc%" | nping -arp %cmip% -c 1
if errorlevel 1 set cmip=
if defined find /I "%n1ipmi%" | nping -arp %n1ip% -c 1
if errorlevel 1 set n1ip=
if defined find /I "%n2ipmi%" | nping -arp %n2ip% -c 1
if errorlevel 1 set n2ip=
::避免arp不完整 除了CM之外缺一個IP則用nmap再scan一次
if defined cmip goto startweb
if not defined n1ip goto nmap
if not defined n2ip goto nmap
del arp.txt
goto startweb
:nmap
::呼叫變數bat 並將mac存成以:間隔的格式
call \\logserver\2in1\N19log\sn\small\%psn%.bat
set cmbmc=%cmbmc:~0,2%:%cmbmc:~2,2%:%cmbmc:~4,2%:%cmbmc:~6,2%:%cmbmc:~8,2%:%cmbmc:~10,2%
set n1ipmi=%n1ipmi:~0,2%:%n1ipmi:~2,2%:%n1ipmi:~4,2%:%n1ipmi:~6,2%:%n1ipmi:~8,2%:%n1ipmi:~10,2%
set n2ipmi=%n2ipmi:~0,2%:%n2ipmi:~2,2%:%n2ipmi:~4,2%:%n2ipmi:~6,2%:%n2ipmi:~8,2%:%n2ipmi:~10,2%
echo Network Scanning...
::nmap scan並抓出IP與MAC的list
nmap -sn -n --max-parallelism 100 172.16.0-7.0-255>>scan.txt
for /f "tokens=3 delims= " %%i in ('find "MAC" scan.txt') do echo %%i>>mac.txt
for /f "tokens=5 delims= " %%j in ('find "172.16." scan.txt') do echo %%j>>ip.txt
::這段我是網路上抓的 老實說我也不懂這段運作方式
::我只知道他可以幫我把IP與MAC整理成對應的list
set m=0
for /f "delims=" %%a in (mac.txt) do (set /a m+=1
set a!m!=%%a)
set n=0
for /f "delims=" %%b in (ip.txt) do (set /a n+=1
set b!n!=%%b)
for /l %%c in (1,1,%m%) do (
echo !a%%c! !b%%c!>>arp.txt)
echo Searching %psn% BMC's IP Address...
::找出對應IP 存成變數
for /f "tokens=2" %%a in ('findstr /I "%cmbmc%" arp.txt') do set cmip=%%a
for /f "tokens=2" %%a in ('findstr /I "%n1ipmi%" arp.txt') do set n1ip=%%a
for /f "tokens=2" %%a in ('findstr /I "%n2ipmi%" arp.txt') do set n2ip=%%a
::檢查變數儲存的是否為IP 不是則刪除變數
echo %cmip% | find "172.16."
if errorlevel 1 set cmip=
echo %n1ip% | find "172.16."
if errorlevel 1 set n1ip=
echo %n2ip% | find "172.16."
if errorlevel 1 set n2ip=
::nmap掃到的主機都是活的 所以不做篩選 有IP就直接打開
if defined cmip goto startweb
if defined n1ip goto startweb
if defined n2ip goto startweb
echo %psn% BMC's IP Address not found. & pause & goto loop
:startweb
echo @echo off>>StartChrome.bat
echo cd "C:\Program Files (x86)\Google\Chrome\Application">>StartChrome.bat
echo start chrome.exe %cmip% %n1ip% %n2ip%>>StartChrome.bat
echo exit>>StartChrome.bat
start StartChrome.bat
timeout 1
goto loop
你先去 ping broadcast address 或是 Class D 的 224.0.0.1, 然後用 arp -a 指令不就可以看到全部的 Mac address vs IP 對應表了?....還幫你排好好, 不用再整理...
Nirsoft
wnetwatcher
可以自動輸出 TXT
輸出的內容也可以自定
我用Wireshark看了一下,wnetwatcher是透過ARP Request封包實現Host Discover的
依他每秒發送的封包數來看,掃描速度不及nmap,另外我比較希望找可以在cmd下操作的Tool,以便實現自動化
然後我意外的發現nmap底下有帶一款nping,可以產生ARP Request封包nping -rate 255 --arp-type ARP x.x.x.x | find "XX:XX:XX:XX:XX:XX"
第一次實驗rate調太大,把我自己的路由器都癱瘓了XDDD
只是不知道公司網管有沒有設定ARP Reply上限來防範ARP Flooding
rate調太小Scan速度就不如nmap,調太大可能會觸發防禦機制Drop ARP封包,掃了等於沒掃,沒有防禦就可能把公司網路癱瘓,搞不好還被請去喝茶(怕
感覺用ARP Request封包去Scan也不太可行
如果可以用 snmp 然後 librenms 去撈 FDB Table 或是 arp table 是比較省事
我查了一些snmp的工具,架設都需要Linux,操作都在Web上
好像沒辦法在command line下操作
提供兩個方法給您參考:
nmap
nmap -sn -n 192.168.2.0/24 | awk '/Nmap scan report for/{printf $5;}/MAC Address:/{print "-"$3;}'
arp-scan
UNIX : apt(Debian/Ubuntu)或yum/dnf(Redhat/CentOS)或pkg(FreeBSD) install arp-scan
arp-scan 192.168.2.0/24
Windows : arp-scan-windows
arp-scan -t 192.168.2.0/24
20200727 補充 for windows:
需安裝 Gawk for Windows , 語法稍做修改