Question for IT geeks

[Aurel]

Is there a MS-DOS instruction that gives a listing of the IP adresses of all computers in a LAN network? Something similar to ipconfig, but for all the PCs my PC can see on the LAN? TIA

Aurel

[mikester]

No, not really - you would need to get an external program to really do that.

You can try arp -a which will show all the arp entries you computer knows about but that will only show things on the local subnet your computer is actually talking too.

You can also do a netstat -an which will show any established connections to your computer.

Lastly you can do a ping to the network broadcast address but that address depends on the size of the subnet on your network.

For example is your network is 192.168.100.0 with a netmask of 255.255.255.0 the broadcast address is 192.168.100.255.

if you ping that address then all hosts on that network will answer, if you're using Linux/UNIX you'll need to add a -b to the end of the command. Most routers won't allow this sort of ping to occur.

Your best bet is to use an IP scanner like this one:

http://www.angryziber.com/ipscan/

[PcarPhil]

Ip sniffer will do this. It's not a Dos command but it'll do:
http://www.snapfiles.com/get/ipsniffer.html

[Aurel]

Thanks!

Aurel

[masraum]

You can ping 224.0.0.1 and then arp -a.

224.0.0.1 is a special multicast address that requestes that all hosts on a network reply. And then with the arp -a you should see a list. You should actually be able to see the hosts as they reply so the arp -a is not 100% necessary. This may not work for PCs that have Windows XP firewall enabled.

Here's a sample of what you'd get.

H:\>ping 224.0.0.1

Pinging 224.0.0.1 with 32 bytes of data:

Reply from 10.20.166.254: bytes=32 time<1ms TTL=255
Reply from 10.20.166.118: bytes=32 time<1ms TTL=64
Reply from 10.20.166.118: bytes=32 time<1ms TTL=64
Reply from 10.20.166.118: bytes=32 time<1ms TTL=64

Ping statistics for 224.0.0.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

H:\>arp -a

Interface: 10.20.166.49 --- 0x10003
Internet Address Physical Address Type
10.20.166.102 00-0e-7f-e7-c1-63 dynamic
10.20.166.118 00-13-21-26-61-33 dynamic
10.20.166.254 00-0d-ed-c0-08-43 dynamic

[mikester]

Originally posted by masraum
You can ping 224.0.0.1 and then arp -a.

224.0.0.1 is a special multicast address that requestes that all hosts on a network reply. And then with the arp -a you should see a list. You should actually be able to see the hosts as they reply so the arp -a is not 100% necessary. This may not work for PCs that have Windows XP firewall enabled.

Here's a sample of what you'd get.

Oiy!

That's a much better answer, I concede defeat.

[masraum]

if you want a good windows scanner, superscan is a pretty good one as well.

http://www.foundstone.com/index.htm?subnav=resources/navigation.htm&subcontent=/resources/proddesc/superscan.htm

[PcarPhil]

Originally posted by masraum
You can ping 224.0.0.1 and then arp -a.

224.0.0.1 is a special multicast address that requestes that all hosts on a network reply. And then with the arp -a you should see a list. You should actually be able to see the hosts as they reply so the arp -a is not 100% necessary. This may not work for PCs that have Windows XP firewall enabled.

Here's a sample of what you'd get.

Very cool. Thanks!

[azasadny]

You can download a good scanner from GFI LanGuard that won't cost you anything for a 30 day trial. It will tell you more than you want to know...

[Aurel]

Originally posted by masraum
You can ping 224.0.0.1 and then arp -a.

224.0.0.1 is a special multicast address that requestes that all hosts on a network reply. And then with the arp -a you should see a list. You should actually be able to see the hosts as they reply so the arp -a is not 100% necessary. This may not work for PCs that have Windows XP firewall enabled.

Here's a sample of what you'd get.

Exactly what I was thinking about. You are the Geekmaster! Thanks.

Aurel

[Tim Walsh]

224.0.0.1 produced some interesting results on my end. I get about 4-5 of the 100+ machines on my subnet to reply, even though I can manually ping machines that don't reply to the 244.0.0.1 ping. What I did in this situation was to create a batch file to ping each machine in the subnet then check to see if there was a resulting arp table entry

[VincentVega]

You need to make sure your routers are forwarding multicast for that to work. On a simple flat network it should work fine. If you are using dhcp you should have a report on the server.

[Joeaksa]

Good info!

[id10t]

With DHCP on the LAN, just check your leases file. Otherwise, use something fun like nmap to search for active machines on your subnet.

[Halm]

From a CMD prompt: net view