Testing intranet network

Question

This is probably a question already discussed here and there.

I'd like to try to gathering here all the information.

Suppose I'm on a machine connected to a network. This network has access to the internet.

I'd like to write a bash script to detect the maximum information possible in order to

1. Map the network around me

   1. Number of devices connected
   2. Types of services offered by each device

2. Know how many devices I must run through in order to reach the router to the internet (counting hops)

3. Latency between each step

4. Strength of signal if the link between A and B is wireless

5. Maximum uplink and downlink speed between two devices on the intranet

I don't need the final script, I'd like to get dirty doing this, but I need tips on the right approach. I've got a good knowledge of network theory but really a poor knowledge of the practical side and the best I have come up with is flooding the subnet with pings and trying to reverse engineer the network using it.. rubbish!

Answer 1

This is a very wide question, there isn't a single popular tool that does everything. People who do this for a living use a collection of existing tools (some open-source, some not), arranged and configured to their liking, plus a few home-made ones.

To map the network, use nmap. It comes with a plethora of options (including “flooding the subnet with ping”, but also many more useful settings). If you're doing this because you're discovering a network, a graphical view of the information that nmap discovers can be useful; try Cheops or Fe3d, and watch out for progress on NmapDiag.

Here are a few related questions on Server Fault:

• Taming an existing network
• Automated Network Mapping
• Network Diagramming software options?
• Visual Network Topology Map?
• Junior admin - how to discover/map the network to increase understanding?
• and document it as you go along

If you're looking for vulnerabilities, the name that stands out is Nessus.

Here are a few related questions on Security Stack Exchange:

• Initial steps of network mapping
• Determining network topology from the outside
• Nessus vs third-party scans.

To see where your packets go through to reach a host, use traceroute, or a variant such as traceroute6,tracepathortcptraceroute`, depending on which protocol you're interested in.

For proper bandwidth evaluation, you're going to need cooperation from the other end. The best way to measure network throughput is to do it with the application itself. If you're not getting as much as you hoped, there's no magic bullet, you'll need to check from various points and test whether the server itself or some network link is the bottleneck.