NMAP Package
-
You do understand that /16 is HUGE compared to a /24 right... So trying to scan that whole subnet could for sure timeout..
-
@johnpoz I understand then how do I scan to make sure all hosts are up. using a ranges that I have host on them or somehow extend the time on the nmap if that possable !!!
-
What exactly are you trying to find out? Why an the F would you be using a /16 is beyond me.. You actually have 65K some hosts? ;) A /16 is not a mask you would ever use on a device - its a mask you would use as a summary route, or a firewall rule..
You want to use nmap to check is something is on? Not the right tool to be honest, nor would I be using the gui.. You do understand you can just look in your arp table - if the device has talked pfsense at all in like 20 minutes it will be listed in your arp table.
So lets say namp came back in like 10 seconds with a list.. What would you then do with this list? What is the end goal here? nmap not really a network monitoring tool.. Its an information gathering tool..
Are you looking for a tool to tell you what hosts are up?
-
@johnpoz YES Arp table is not a real time it need time to expired I found that if I scan range like nmap -sP 10.0.10.1-250 I can find if the host is currently online, but I will go with some monitoring software in the near future so it is ok just needed some temporally solution until I find the right software for monitoring my whole network
Thank you
-
I like domotz, not free.. But it alerts me when my son's are at the house because their phones connect to my network and when they leave ;)
Thera are many monitoring tools.. All comes down to what your looking to monitor, that they just are online?
But if your going to be doing anything that scans.. Your going to want to adjust your mask to have a more realistic sized segment.. Scanning even a /24 is large when you have only a handful of devices. I keep meaning to trim mine down because domotz arps the whole segment.. /28 would be large enough for any specific segment..
My project for tmrw ;)
-
@johnpoz No I don't do that kind of segmentation :)
What I mean is let say I have VLAN 10 - 10.10.0.0/16 interface I will give the servers range : 10.10.80.x hosts 10.10.50.x and so on also 10.x.0.0 where x will be the vlan+location I don't believe that my network is done by the book but I like it this way and that's all I can do for now actually. But how do you segmenting your network if you have so many different stuff I have to create an lots of interfaces to separate them the way I do. I've been with /24 mask for a very long time but my network expend to 3 locations the only small segmentation I have is for a OPENVPN REMOTE ACCESS /30 because I don't need more then 1 user to connect at the time. -
yeah good luck scanning a /16 - again a /16 is not a network segment that would ever be used. Its a summary route, its a firewall rule to allow or block downstream.
If you want your to use 10.10.80 and 10.10.50 sure go ahead - but those should be different /24s not all under 1 /16 - how do you expect to firewall between them? You just have 1 big flat network all on the same layer 2 without any segmentation for control or security.
-
@johnpoz Hello
I don't want to control traffic between them this is all MGMT interface
What you propose is to segment this network on /24. Use L3 switch to control them and firewall
I don't understand. What do you do in this case. -
no you do not need a L3 switch.. pfsense - ie the firewall is a router.
-
@johnpoz ok but for each subnet I have to create an interface here in where I am LOC 3 I dont have much equipment but in my office location I have lots of stuff and I am currently ONE MAN SHOW and I intend to stay that way That's why I want to have less groups to worried about in fact there is no production network on my locations most of the interfaces are working offline controlled from a single interface each controlling interface is connected to to the other with openvpn tunnel As you can see I am not doing this by the book I am not a network admin I just trying to learn as much as I need to keep my stuff up and running.
-
How many devices do you have - total number? 10, 20, 100?? 1000?
The ip space of /24 allows 254 devices. If you do not have any where close to this number then just use a /24
Trying to scan 254 possible hosts doesn't take long... But a /16 has POSSIBLE 65,534 of them - that is going to take a SHIT TON of time to scan.. waiting to see if it answers - especially if you do a no ping sweep.
If you want to use nmap as some tool to find out what is online - using a /16 is just plain not going to be viable in any realistic amount of time.
If all you want is a FLAT network - then use a realistic network size based upon the number of devices you or might grow to in a few years. a /23 would give you 510 IPs to work with.
-
@johnpoz It is more like how many different devices I don't have 1000 devices but I need to group them some how so I can remember them but they all need the same rules I don't see a reason except scanning them to put them on different smaller subnets as I said I am using nmap to scan a range of IPs similar to what you proposing just they are in the same subnet ether way I have to scan them separately right?
-
Scan you different groups mask then.. And again nmap is not the correct tool to check if what is currently online in you network.. Arp ping would be better tool
Group them then 192.168.10-20 is printers, 21-30 is servers, etc. Use of a /16 so you can "group" specific IPs is pretty pointless.
If what your looking for is what is online then use a networking monitoring software..
