Get a list of all computers on a network w/o DNS

Question

Greetings,

I need a way (either via C# or in a .bat file) to get a list of all the computers on a given network. Normally, I use "net view", but this tends to work (from my understanding) only within your domain. I need the names (or at least the IP Addresses) of all computers available on my network.

Being able to get all computers on a domain that isn't mine (in which case I'd use WORKGROUP, or whatever the default is) would also work.

Answer 1

Nmap is good for this - use the -O option for OS fingerprinting and -oX "filename.xml" for output as xml that you can then parse from c#.

A suitable commandline would be (where 192.168.0.0/24 is the subnet to scan):

nmap -O -oX "filename.xml" 192.168.0.0/24

leave out the -O if you aren't interested in guessing the OS - if you just want a ping sweep use -sP, or read the docs for the myriad other options.

Answer 2

To expand on what Unkwntech has said -

You can also do a "broadcast" ping to avoid having to ping each IP address individually.

Immediately after than you can use "arp" to examine the ARP cache and get a list of which IP addresses are on which MAC address.