# Network scanning

We'll be using the program IPnetmonitor on the mac computers:

[https://www.sustworks.com/site/prod\_ipmx\_overview.html](https://www.sustworks.com/site/prod_ipmx_overview.html)

<figure id="bkmrk-screenshot-2025-02-0">![Screenshot 2025-02-02 at 12.41.43 PM.png](https://bookstack.kamuela.org/uploads/images/gallery/2026-09/GDxcp96DeCRGO37D-screenshot-2025-02-02-at-12-41-43-pm-i7hgqfp4.png)<figcaption>Screenshot 2025-02-02 at 12.41.43 PM.png</figcaption></figure>  
Type <span id="bkmrk-command-l" style="background-color: rgb(236, 238, 168); color: rgb(102, 102, 102);">command-L</span> to get to the launcher.<div id="bkmrk-let%27s-try-a-few-comm">Let's try a few commands:</div><div id="bkmrk-find-your-iphone-on-">Find your iPhone on the network:</div><div id="bkmrk-join-the-elab-networ">

1. join the elab network on your phone
2. open ipnm, and choose address scan
3. IP addresses are "leased" to users on the network 10.14.254.0/24
4. scan the network 10.14.254.0/24
5. on your phone, look at the connection information for the MAC address (MAC is not a mac thing, it is the identity of the hardware in your phone, it stands for machine access control)
6. see if you can find your phone on the network

<div>Here's what this means:</div><div>

- All IP addresses (for now) follow what is known as IPv4, where each address in the world has 4 pairs of numbers between 1-254 (this is from binary versions of 2^n)
- Inside IP addresses are "fake" meaning they don't show up on the internet
- Try the <span style="background-color: rgb(236, 238, 168); color: rgb(102, 102, 102);">DNSlookup</span> tool, for these:
- www.apple.com
- www.google.com
- elab.hpa.edu
- physics.hpa.edu
- Notice that the outside "real addresses" have various numbers, but those inside the elab all start with 10.14.x.y
- The IP address for your phone is borrowed for a short time while in the elab, so we can recycle the addresses.
- Every address in the elab starts with 10 (HPA) 14 (elab) then two more sets of numbers.
- Address scan these:
- 10.14.88.0/24
- 10.14.6.0/24
- 10.14.5.0/24

</div><div>  
</div><div>Ok, so what is the 24 all about?</div><div>

- Imagine you are in a hotel with 254 rooms all in one long hallway.
- Every time someone walks by, you hear them.
- If you could instead have more floors, and shorter hallways, your room would be quieter
- We "mask" the network to do this
- 255.255.255.0 means 254 computers on a network, we call this a /24 network
- 255.255.0.0 means 254x254 (65516) addresses
- Try this from the HPA wifi network and see what address you get

</div><div>  
</div><div>Now open the network settings on your computer and notice three things:</div><div>

- IPv4 address
- subnet mask
- router/gateway
- DNS servers

</div><div>  
</div><div>These are the absolute minimum needed to configure any internet device (computer, smartphone, camera, etc.) on a network</div><div>

- <span style="font-weight: bold;">IPv4 address:</span> the address of your machine, may be set to DHCP, meaning leased address (dynamic host configuration protocol)
- <span style="font-weight: bold;">subnet mask: </span>depends on the "scope" of your network
- <span style="font-weight: bold;">router</span>: the gateway to get out to the internet
- <span style="font-weight: bold;">DNS server:</span> where to go to lookup or translate names into IP addresses

</div><div>  
</div><div>Look for the same things on your phone...</div><div>what do you notice?</div><div>  
</div><div>Next, try the other tools on the launcher, like link rate and ping</div><div>You can use link rate to test your ethernet cables for speed...</div><div>  
</div><div><span style="font-weight: bold;">Hacker Challenges:</span></div><div><span style="font-weight: bold;">Find your phone: Address Scan</span></div><div>

1. Use the address scan to find your phone, by IP and MAC address
2. compare to what it says on your phone
3. enable "private address" on your phone and repeat
4. why is this useful?

<div><span style="font-weight: bold;">Bonjour scan</span></div></div><div>

1. use the bonjour scan to locate the "imac-a" machine
2. find all of the data about it
3. why do some machines have more than one address?

<div><span style="font-weight: bold;">Connections tool</span></div></div><div>

1. use the connections tool to monitor the connections your computer makes
2. open several web pages and notice the connections made
3. are these more than just the pages you want?
4. why is the internet so slow?

<div><span style="font-weight: bold;">DHCP lease tool</span></div><div>

1. use the DHCP lease tool to see your leased address
2. release and renew your address, note the server that gives out the addresses
3. is this the same as the router?

<div><span style="font-weight: bold;">DNS lookup tool</span></div></div><div>

1. use the DNS lookup tool to lookup addresses inside and outside our network
2. use the DNS query option to lookup elab.hpa.edu using our DNS server (look on board) and 8.8.8.8 (google DNS)
3. why are these different?

<div><span style="font-weight: bold;">interface info</span></div></div><div>

1. open interface info and update
2. what do you notice about inside and external address?
3. which would you use for a minecraft server inside our network?
4. what is your network speed?

<div><span style="font-weight: bold;">Link Rate</span></div></div><div>

1. test your link rate to other computers in our lab and outside
2. what do you notice about the speed?
3. if you like, test your ethernet cable for speed, linking to another computer, or a network switch

<div><span style="font-weight: bold;">Monitor</span></div></div><div>

1. monitor both your ethernet and your wireless network for traffic
2. is there any time when traffic is zero?
3. browse the web and watch

<div><span style="font-weight: bold;">Ping</span></div><div>

1. ping devices from your address scan above
2. note return time
3. ping from ethernet if available

<div><span style="font-weight: bold;">Port scan</span></div></div><div>

1. be careful with this, it is like a burglar checking unlocked doors
2. scan a device in our room for ports (1-900) notice open ports
3. test with one of our servers, note the ports
4. test on a pc, notice the ports open
5. ask about common ports, you will need these

<div><span style="font-weight: bold;">Service scan</span></div></div><div>

1. use service scan on your device and on a server (see board)
2. what can this tell you about a server?
3. why is this blocked by some servers?

<div><span style="font-weight: bold;">Subnet calculator</span></div></div><div>

1. pick a 10.14.x.y address
2. set prefix length to 16
3. notice the network address
4. repeat with a 192.168.1.2 address
5. what do you notice?

<div><span style="font-weight: bold;">TCPdump</span></div></div><div>

1. be careful with this tool: you can watch all traffic on the network and see passwords and logins
2. run with several options, browse the web and see if you can identify your traffic
3. why is some traffic not readable?

<div><span style="font-weight: bold;">TCP info</span></div></div><div>

1. this tool diagnoses internet connections
2. notice things like dropped packets and retransmits
3. ask about packets, we'll need to understand these

<div><span style="font-weight: bold;">Traceroute</span></div></div><div>

1. trace the route to inside and outside addresses
2. how could you use this to determine slow links?
3. test using UDP, TCP and ICMP
4. ask in class about what these mean

</div><div>  
</div></div></div><div><span style="font-weight: bold;">Network tools for raspberry pi:</span></div><div>We first have to make sure our pi is updated:</div><div><span style="background-color: rgb(236, 238, 168); color: rgb(102, 102, 102);">sudo apt update</span></div><div>Next try the commands ping, traceroute and nslookup (from before)</div><div>  
</div><div>Advanced commands: you may have to install these using <span style="background-color: rgb(236, 238, 168); color: rgb(102, 102, 102);">sudo apt install nmap</span> for example...</div><div>

- <span style="font-weight: bold;">wavemon</span>
- <span style="font-weight: bold;">speedtest-cli </span>(install)
- <span style="font-weight: bold;">nmap -sP 10.14.88.0/24</span>
- <span style="font-weight: bold;">sudo arp-scan 10.14.88.0/24</span>
- <span style="font-weight: bold;">sudo iftop</span>
- <span style="font-weight: bold;">ping</span>
- <span style="font-weight: bold;">nslookup</span>
- <span style="font-weight: bold;">traceroute</span>
- <span style="font-weight: bold;">netstat or ss</span>
- <span style="font-weight: bold;">cat /proc/cpuinfo</span>
- <span style="font-weight: bold;">hardinfo</span>
- <span style="font-weight: bold;">ifconfig </span>
- <span style="font-weight: bold;">ip addr show (note MAC address shows up)</span>

<div><span style="font-weight: bold;">tcpdump is a powerful tool for watching network traffic</span></div><div><span style="font-weight: bold;">unencrypted passwords and logins show up using this tool:</span></div>

- sudo tcpdump -i eth0 (capture all on interface ethernet0)
- sudo tcpdump -c 5 -i eth0 (capture 5)
- sudo tcpdump -A -i eth0 (ascii format)
- sudo tcpdump -D (show interfaces)
- sudo tcpdump -XX -i eth0 (hex and ascii)
- sudo tcpdump -w 0001.pcap -i eth0. (captures packets to a file for later cracking)
- sudo tcpdump -n -i eth0 (addresses)
- sudo tcpdump -i eth0 tcp  (only tcp packets)
- sudo tcpdump -i eth0 port 22 (only see ssh traffic)
- sudo tcpdump -i eth0 port 80 (only see web traffic)
- sudo tcpdump -i eth0 port 443 (only see secure web traffic)
- sudo tcpdump -i eth0 src 10.14.88.81 (only from one machine)
- sudo tcpdump -i eth0 dst 10.14.88.81 (only to one machine)

<div>  
</div><div><span style="font-weight: bold;">If you have permission, go back to the mac and try tcpdump to watch your web traffic...</span></div><div><span style="font-weight: bold;">  
</span></div><div><span style="font-weight: bold;">Nmap commands</span></div><div><span>[https://www.recordedfuture.com/threat-intelligence-101/tools-and-techniques/nmap-commands](https://www.recordedfuture.com/threat-intelligence-101/tools-and-techniques/nmap-commands)</span><span></span>  
</div>  
</div><div>  
</div><div>  
</div><div>  
  
</div></div>---

<small>Migrated from Apple Server Wiki. Original page ID: z585E0m</small>