My company has a class A network that contains various subnets. I need to automate a way to produce a list of all online devices (in all the subnets). To start, just a list of responsive private IPs would be great.
I like using arp-scan which is great for my subnet. However, ARP is not routable, so it does not work for going across to other subnets.
Maybe some kind of ping sweep using nmap? It can't take all day though.
Any ideas or commands that I could use?
One way to do this is simply using ping. It is true that running ping or fping against a list of millions of hosts is going to take some time, but you could parallelize this task by splitting the IP addresses in ranges and launching several ping commands in parallel.
I suggest you don't use nmap. It is far more powerful than ping, but if you only use it to find out if hosts are alive, ping is more than enough. Also, some devices may not like getting port scanned. Not to mention your security systems may treat this as an attack.
If you can access network devices, you can do this in a passive way, by periodically checking the ARP tables of your default gateways (routers, firewalls). This way you will get hosts that have spoken in the last X minutes, where X is the ARP table timeout.
