0

I'm working on a program that depends on scanning the local network for all connected devices and getting their MAC address.

To do this, I'm running the following command:

nmap -sn 10.0.0.*

This is working for the most part. The issue I'm having is that sometimes the result correctly outputs information about all of the devices on the network, but other times it only outputs information about my router.

I know that sometimes devices might drop off the network temporarily, but it seems like at a minimum it should return two results (one for the computer I'm running the command from and one from the router).

Is there any explanation for this behavior, or circumstances that might cause it? Alternately, is there a better way to achieve the same result with more consistency?

In case it's relevant, I'm running nmap 6.47, installed with brew on a MacBook connected wirelessly to the router.

UPDATE

After making the sample I realized that I actually am never getting fewer than two results. It's just that the address for the computer I'm running the command from (10.0.0.54) doesn't return a MAC address. Sorry for the misinformation, I was running the output through grep to extract the MAC addresses. However, when I was making the sample there were certainly more than two devices on the network - at least one of my other computers was connected.

Sample:

Normal result:

$ nmap -sn 10.0.0.*
Starting Nmap 6.47 ( http://nmap.org ) at 2015-07-03 18:53 CDT
Nmap scan report for 10.0.0.1
Host is up (0.0043s latency).
MAC Address: B8:9B:C9:98:40:92 (SMC Networks)
Nmap scan report for 10.0.0.50
Host is up (0.023s latency).
MAC Address: B0:05:94:04:CA:75 (Liteon Technology)
Nmap scan report for 10.0.0.51
Host is up (0.080s latency).
MAC Address: F8:27:93:B4:09:F9 (Apple)
Nmap scan report for 10.0.0.57
Host is up (0.093s latency).
MAC Address: 78:4B:87:47:EA:50 (Murata Manufacturing Co.)
Nmap scan report for 10.0.0.58
Host is up (0.070s latency).
MAC Address: A4:5E:60:B8:D5:A7 (Unknown)
Nmap scan report for 10.0.0.59
Host is up (0.094s latency).
MAC Address: 70:3E:AC:1C:DB:D8 (Unknown)
Nmap scan report for 10.0.0.54
Host is up.
Nmap done: 256 IP addresses (7 hosts up) scanned in 26.23 seconds

Not as many devices as expected:

$ nmap -sn 10.0.0.*
Starting Nmap 6.47 ( http://nmap.org ) at 2015-07-03 18:55 CDT
Nmap scan report for 10.0.0.1
Host is up (0.0044s latency).
MAC Address: B8:9B:C9:98:40:92 (SMC Networks)
Nmap scan report for 10.0.0.54
Host is up.
Nmap done: 256 IP addresses (2 hosts up) scanned in 2.04 seconds

$ nmap -sn 10.0.0.*
Starting Nmap 6.47 ( http://nmap.org ) at 2015-07-03 18:55 CDT
Nmap scan report for 10.0.0.1
Host is up (0.0034s latency).
MAC Address: B8:9B:C9:98:40:92 (SMC Networks)
Nmap scan report for 10.0.0.54
Host is up.
Nmap done: 256 IP addresses (2 hosts up) scanned in 2.03 seconds

$ nmap -sn 10.0.0.*
Starting Nmap 6.47 ( http://nmap.org ) at 2015-07-03 18:55 CDT
Nmap scan report for 10.0.0.1
Host is up (0.0037s latency).
MAC Address: B8:9B:C9:98:40:92 (SMC Networks)
Nmap scan report for 10.0.0.54
Host is up.
Nmap done: 256 IP addresses (2 hosts up) scanned in 2.06 seconds

Normal result again:

$ nmap -sn 10.0.0.*
Starting Nmap 6.47 ( http://nmap.org ) at 2015-07-03 18:55 CDT
Nmap scan report for 10.0.0.1
Host is up (0.025s latency).
MAC Address: B8:9B:C9:98:40:92 (SMC Networks)
Nmap scan report for 10.0.0.50
Host is up (0.054s latency).
MAC Address: B0:05:94:04:CA:75 (Liteon Technology)
Nmap scan report for 10.0.0.57
Host is up (0.054s latency).
MAC Address: 78:4B:87:47:EA:50 (Murata Manufacturing Co.)
Nmap scan report for 10.0.0.54
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 7.79 seconds
030
  • 5,901
  • 13
  • 68
  • 110
Sam
  • 103
  • 5
  • `The issue I'm having is that sometimes the result correctly outputs information about all of the devices on the network, but other times it only outputs information about my router` Please add samples. – 030 Jul 03 '15 at 23:21
  • Sorry about that, I added the samples – Sam Jul 04 '15 at 00:04

1 Answers1

0
[vagrant@controller ~]$ man nmap
-d: Increase debugging level (use -dd or more for greater effect)

Add -d to increase the debug level

[vagrant@controller ~]$ nmap -sn X.* -d

Starting Nmap 6.40 ( http://nmap.org ) at 2015-07-04 00:20 UTC
--------------- Timing report ---------------
  hostgroups: min 1, max 100000
  rtt-timeouts: init 1000, min 100, max 10000
  max-scan-delay: TCP 1000, UDP 1000, SCTP 1000
  parallelism: min 0, max 0
  max-retries: 10, host-timeout: 0
  min-rate: 0, max-rate: 0
---------------------------------------------
Initiating Ping Scan at 00:20
Scanning 256 hosts [2 ports/host]
Got ENETUNREACH from sendConnectScanProbe connect()
Got ENETUNREACH from sendConnectScanProbe connect()
doAnyOutstandingRetransmits took 32ms
Completed Ping Scan at 00:20, 2.62s elapsed (256 total hosts)
Overall sending rates: 387.02 packets / s.
mass_rdns: Using DNS server 8.8.8.8
Initiating Parallel DNS resolution of 256 hosts. at 00:20
mass_rdns: 8.01s 0/1 [#: 1, OK: 0, NX: 0, DR: 0, SF: 0, TR: 3]
Completed Parallel DNS resolution of 256 hosts. at 00:21, 8.01s elapsed
DNS resolution of 1 IPs took 8.01s. Mode: Async [#: 1, OK: 1, NX: 0, DR: 0, SF: 0, TR: 3, CN: 0]
Nmap scan report for X.0 [host down, received net-unreach]
Final times for host: srtt: 861 rttvar: 5000  to: 100000
Nmap scan report for test.testdomain (X.1)
Host is up, received syn-ack (0.0057s latency).
Final times for host: srtt: 5654 rttvar: 5654  to: 100000
Nmap scan report for X.2 [host down, received no-response]
Nmap scan report for X.3 [host down, received no-response]
Nmap scan report for X.4 [host down, received no-response]
Nmap scan report for X.5 [host down, received no-response]
Nmap scan report for X.6 [host down, received no-response]
Nmap scan report for X.7 [host down, received no-response]
Nmap scan report for X.8 [host down, received no-response]
Nmap scan report for X.9 [host down, received no-response]
Nmap scan report for X.10 [host down, received no-response]
Nmap scan report for X.11 [host down, received no-response]
Nmap scan report for X.12 [host down, received no-response]
Nmap scan report for X.13 [host down, received no-response]
Nmap scan report for controller.testdomain (X.14)
Host is up, received conn-refused (0.00041s latency).
Final times for host: srtt: 406 rttvar: 3846  to: 100000
Nmap scan report for X.15 [host down, received no-response]
Nmap scan report for X.16 [host down, received no-response]
Nmap scan report for X.17 [host down, received no-response]
Nmap scan report for X.18 [host down, received no-response]
...
Nmap scan report for X.250 [host down, received no-response]
Nmap scan report for X.251 [host down, received no-response]
Nmap scan report for X.252 [host down, received no-response]
Nmap scan report for X.253 [host down, received no-response]
Nmap scan report for X.254 [host down, received no-response]
Nmap scan report for X.255 [host down, received net-unreach]
Final times for host: srtt: 175 rttvar: 5000  to: 100000
Read from /usr/bin/../share/nmap: nmap-payloads.
Nmap done: 256 IP addresses (2 hosts up) scanned in 10.70 seconds

add -dd to increase the debug level more.

The debug will clarify why there is a difference between the snippets that have been added to the question.

030
  • 5,901
  • 13
  • 68
  • 110
  • Thanks, this helped. I think it was just issues with the wireless connection. I tried running it while connected with ethernet and it didn't get the same problems – Sam Jul 04 '15 at 17:10