Scanning your network for PCs, their services, and IP address conflicts

[Rich]

I've just submitted a new extension called rollcall. The info file pretty much sums it up:

Code: [Select]

Title: rollcall.tcz
Description: Scans local network for PCs and services.
Version: 0.9
Author: Richard Rost
Original-site: None
Copying-policy: See /usr/local/share/doc/License/rollcall-License.txt
Size: 12K
Extension_by: Rich
Tags: scan local network services
Comments: This program scans all configured network interfaces
and attempts to identify services running on this and any
remote computers. Any duplicate IP and MAC addresses will
be displayed in red. This program must be run as root.

Usage:  rollcall [-v | Services]

Options:
        -v      Show verbose output for all found sevices
listed below
Services:
DHCP NFS SMB SSH FTP PING TELNET HTTP TFTP DNS NTP TSTAMP
Only show verbose output for any of the above services
Services are not case sensitive.

Example: sudo rollcall tstamp http telnet

This extension is PPI compatible.
Change-log: 2019/3/16  Original release
Current: 2019/3/16  Original release
This is a sample run of the program:

Code: [Select]

tc@box:~/findpcs/src/rollcall$ sudo ./rollcall
rollcall version 0.9 Apr 3, 2015
Copyright Richard A. Rost Mar 16 2019 13:37:41

Host Name=box
eth0  IP Address=192.168.1.30  Bcast=192.168.1.255  Mask=255.255.255.0

Scanning from 192.168.1.1 to 192.168.1.254 on eth0
 IP Address        Mac Address     Services
--------------------------------------------------------------------------------
192.168.1.1     00:1f:90:a1:43:18  ARP, DHCP, PING, HTTP, DNS, TSTAMP
192.168.1.3     00:30:1e:8b:a3:38  ARP, PING, TELNET, HTTP
192.168.1.4     04:a1:51:a4:d3:f9  ARP
192.168.1.5     00:1a:a0:0b:e8:0f  ARP
192.168.1.30    00:02:e3:07:6a:d4  ARP, NFS, PING, TSTAMP
192.168.1.45    78:ac:c0:44:28:7b  ARP, NFS, PING, TSTAMP
192.168.1.47    00:0c:6e:74:7c:60  ARP, NFS, PING, TSTAMP
192.168.1.100   00:21:43:01:f7:2b  ARP, PING
192.168.1.101   00:1e:5a:ce:0c:dc  ARP, PING
tc@box:~/findpcs/src/rollcall$
Here is what happens if there is a duplicate IP address:

eth0  IP Address=192.168.1.30  Bcast=192.168.1.255  Mask=255.255.255.0 

Scanning from 192.168.1.1 to 192.168.1.254 on eth0
 IP Address        Mac Address     Services
--------------------------------------------------------------------------------
192.168.1.1     00:1f:90:a1:43:18  ARP, DHCP, PING, HTTP, DNS, TSTAMP
192.168.1.3     00:30:1e:8b:a3:38  ARP, PING, TELNET, HTTP
192.168.1.4     04:a1:51:a4:d3:f9  ARP
192.168.1.5     00:1a:a0:0b:e8:0f  ARP
192.168.1.30    00:02:e3:07:6a:d4  ARP, NFS, PING, TSTAMP
192.168.1.30    00:0c:6e:74:7c:60  ARP
192.168.1.45    78:ac:c0:44:28:7b  ARP, NFS, PING, TSTAMP
192.168.1.100   00:21:43:01:f7:2b  ARP, PING
192.168.1.101   00:1e:5a:ce:0c:dc  ARP, PING

Here is what happens if there is a duplicate MAC address:

eth0  IP Address=192.168.1.30  Bcast=192.168.1.255  Mask=255.255.255.0 

Scanning from 192.168.1.1 to 192.168.1.254 on eth0
 IP Address        Mac Address     Services
--------------------------------------------------------------------------------
192.168.1.1     00:1f:90:a1:43:18  ARP, DHCP, PING, HTTP, DNS, TSTAMP
192.168.1.3     00:30:1e:8b:a3:38  ARP, PING, TELNET, HTTP
192.168.1.4     04:a1:51:a4:d3:f9  ARP
192.168.1.5     00:1a:a0:0b:e8:0f  ARP
192.168.1.30    00:02:e3:07:6a:d4  ARP, NFS, PING, TSTAMP
192.168.1.45    78:ac:c0:44:28:7b  ARP, NFS, PING, TSTAMP
192.168.1.47    78:ac:c0:44:28:7b  ARP
192.168.1.100   00:21:43:01:f7:2b  ARP, PING
192.168.1.101   00:1e:5a:ce:0c:dc  ARP, PING

Here is what happens if there are duplicate IP and MAC addresses:

eth0  IP Address=192.168.1.30  Bcast=192.168.1.255  Mask=255.255.255.0 

Scanning from 192.168.1.1 to 192.168.1.254 on eth0
 IP Address        Mac Address     Services
--------------------------------------------------------------------------------
192.168.1.1     00:1f:90:a1:43:18  ARP, PING, HTTP, DNS, TSTAMP
192.168.1.3     00:30:1e:8b:a3:38  ARP, PING, TELNET, HTTP
192.168.1.4     04:a1:51:a4:d3:f9  ARP
192.168.1.5     00:1a:a0:0b:e8:0f  ARP
192.168.1.30    00:02:e3:07:6a:d4  ARP, NFS, PING, TSTAMP
192.168.1.30    78:ac:c0:44:28:7b  ARP
192.168.1.45    78:ac:c0:44:28:7b  ARP, NFS, PING, TSTAMP
192.168.1.100   00:21:43:01:f7:2b  ARP, PING
192.168.1.101   00:1e:5a:ce:0c:dc  ARP, PING

Double faults (2 cards with identical MAC and IP addresses) will not be detected. The programs only dependency is
 /lib/libc.so.6  which is part of the base system so it should work on all versions of Tinycore.

[coreplayer2]

Good job Rich.
I can’t wait to try


Sent from my iPhone using Tapatalk

[Pats]

@Rich ,
Hope your *rollcall will be better than Nmap tool , simple  though not exuastive !
...Best Luck, hope it may evolve into some thing bigger like Acunetix, WireShark etc in future .

... I think , Angry IP scanner and Nessus may be widly used by both small as well as big enterprises like big companies and banks etc.
...Acunetix list is very vast like DNS zone transfer, firewalls, switches and load balancers,  Proxy Servers, SNMP , TLS/SSL  ports,  running services;  routers,  weak passwords and many more. 
Carry-on Rich with good work !

[Rich]

Hi Pats

Hope your *rollcall will be better than Nmap tool , simple  though not exuastive ! ...

Along with reasonably fast and lightweight, that was the goal. The scans shown each took about 5 seconds. If I change my network
cards mask to 255.255.0.0 It would scan the entire 192.168.x.x range which took about 50 seconds.

[Juanito]

posted - thanks

[Pats]

1st Review of rollcall.tcz :
...@Rich ... Tested rollcall ,  same results as per your recent post.
.. Some observations :
1) There is no need to supply any argument to rollcall if listing of all servises is required, as ALL is default argument,  even ARP is listed in o/p.
2) While a user is connected to TCL server thru APPS for dnloading a TCZ , after DNS field even google dot com is displayed along with IP addrs. ...

 **Suggestion** :
It will be better if some headers  like IP adrs, Mac , Services , Status etc are provided abv the listed o/p ... in /tmp/rollcall.txt file along with a Date and TimeStamp at the start of file... , in case someone want to archieve or send it to Admin etc.

... All-in-all a slick and good app for a quick checkup of a small network.
.. Some improvements will be coming in future , I know ! ...

[Rich]

Hi Pats

...
1) There is no need to supply any argument to rollcall if listing of all servises is required, as ALL is default argument,  even ARP is listed in o/p. ...

The command line arguments only effect whether the  /tmp/rollcall.txt  file is created and what is written to it. If xterm is available
it also pops up a new terminal and displays  /tmp/rollcall.txt  using the less command. The file just provides a little more detail of
the responses. This is a sample of the  /tmp/rollcall.txt  file:

Code: [Select]

192.168.1.30    00:02:e3:07:6a:d4  ICMP 123    NTP Unreachable
192.168.1.47    00:0c:6e:74:7c:60  ICMP 123    NTP Unreachable
192.168.1.45    78:ac:c0:44:28:7b  ICMP 123    NTP Unreachable
192.168.1.1     00:1f:90:a1:43:18  ICMP 123    NTP Unreachable
192.168.1.3     00:30:1e:8b:a3:38  ICMP 123    NTP Unreachable
192.168.1.101   00:1e:5a:ce:0c:dc  ICMP 123    NTP Unreachable
192.168.1.100   00:21:43:01:f7:2b  ICMP 123    NTP Unreachable
192.168.1.30    00:02:e3:07:6a:d4  TCP   23 TELNET Refused
192.168.1.45    78:ac:c0:44:28:7b  TCP   23 TELNET Refused
192.168.1.47    00:0c:6e:74:7c:60  TCP   23 TELNET Refused
192.168.1.100   00:21:43:01:f7:2b  TCP   23 TELNET Refused
192.168.1.101   00:1e:5a:ce:0c:dc  TCP   23 TELNET Refused
192.168.1.1     00:1f:90:a1:43:18  TCP   23 TELNET Refused
192.168.1.3     00:30:1e:8b:a3:38  TCP   23 TELNET Login:
192.168.1.1     00:1f:90:a1:43:18  TCP   21    FTP Refused
192.168.1.3     00:30:1e:8b:a3:38  TCP   21    FTP Refused
192.168.1.30    00:02:e3:07:6a:d4  TCP   21    FTP Refused
192.168.1.45    78:ac:c0:44:28:7b  TCP   21    FTP Refused
192.168.1.47    00:0c:6e:74:7c:60  TCP   21    FTP Refused
192.168.1.100   00:21:43:01:f7:2b  TCP   21    FTP Refused
192.168.1.101   00:1e:5a:ce:0c:dc  TCP   21    FTP Refused
192.168.1.1     00:1f:90:a1:43:18  TCP   80   HTTP HTTP/1.0 404 Not FoundContent-Type: text/htmlCache-Control: publicPragma: cacheE
192.168.1.3     00:30:1e:8b:a3:38  TCP   80   HTTP HTTP/1.0 401 UnauthorizedServer: 3Com/v1.0WWW-Authenticate:Basic realm="device"
192.168.1.30    00:02:e3:07:6a:d4  TCP   80   HTTP Refused
192.168.1.45    78:ac:c0:44:28:7b  TCP   80   HTTP Refused
192.168.1.47    00:0c:6e:74:7c:60  TCP   80   HTTP Refused
192.168.1.100   00:21:43:01:f7:2b  TCP   80   HTTP Refused
192.168.1.101   00:1e:5a:ce:0c:dc  TCP   80   HTTP Refused
192.168.1.30    00:02:e3:07:6a:d4  ICMP   0 TSTAMP Days=  0 HMS=21:46:30.793
192.168.1.45    78:ac:c0:44:28:7b  ICMP   0 TSTAMP Days=  0 HMS=21:46:06.926
192.168.1.47    00:0c:6e:74:7c:60  ICMP   0 TSTAMP Days=  0 HMS=21:46:35.717
192.168.1.1     00:1f:90:a1:43:18  ICMP   0 TSTAMP Days=  0 HMS=01:46:29.156
192.168.1.30    00:02:e3:07:6a:d4  ICMP  53    DNS Unreachable
192.168.1.47    00:0c:6e:74:7c:60  ICMP  53    DNS Unreachable
192.168.1.45    78:ac:c0:44:28:7b  ICMP  53    DNS Unreachable
192.168.1.3     00:30:1e:8b:a3:38  ICMP  53    DNS Unreachable
192.168.1.100   00:21:43:01:f7:2b  ICMP  53    DNS Unreachable
192.168.1.101   00:1e:5a:ce:0c:dc  ICMP  53    DNS Unreachable
192.168.1.30    00:02:e3:07:6a:d4  ICMP  69   TFTP Unreachable
192.168.1.47    00:0c:6e:74:7c:60  ICMP  69   TFTP Unreachable
192.168.1.45    78:ac:c0:44:28:7b  ICMP  69   TFTP Unreachable
192.168.1.1     00:1f:90:a1:43:18  ICMP  69   TFTP Unreachable
192.168.1.100   00:21:43:01:f7:2b  ICMP  69   TFTP Unreachable
192.168.1.101   00:1e:5a:ce:0c:dc  ICMP  69   TFTP Unreachable
192.168.1.30    00:02:e3:07:6a:d4  ICMP  67   DHCP Unreachable
192.168.1.47    00:0c:6e:74:7c:60  ICMP  67   DHCP Unreachable
192.168.1.45    78:ac:c0:44:28:7b  ICMP  67   DHCP Unreachable
192.168.1.3     00:30:1e:8b:a3:38  ICMP  67   DHCP Unreachable
192.168.1.100   00:21:43:01:f7:2b  ICMP  67   DHCP Unreachable
192.168.1.101   00:1e:5a:ce:0c:dc  ICMP  67   DHCP Unreachable
192.168.1.1     00:1f:90:a1:43:18  UDP   67   DHCP home
192.168.1.1     00:1f:90:a1:43:18  TCP   22    SSH Refused
192.168.1.3     00:30:1e:8b:a3:38  TCP   22    SSH Refused
192.168.1.30    00:02:e3:07:6a:d4  TCP   22    SSH Refused
192.168.1.45    78:ac:c0:44:28:7b  TCP   22    SSH Refused
192.168.1.47    00:0c:6e:74:7c:60  TCP   22    SSH Refused
192.168.1.100   00:21:43:01:f7:2b  TCP   22    SSH Refused
192.168.1.101   00:1e:5a:ce:0c:dc  TCP   22    SSH Refused
192.168.1.30    00:02:e3:07:6a:d4  ICMP 137    SMB Unreachable
192.168.1.47    00:0c:6e:74:7c:60  ICMP 137    SMB Unreachable
192.168.1.1     00:1f:90:a1:43:18  ICMP 137    SMB Unreachable
192.168.1.45    78:ac:c0:44:28:7b  ICMP 137    SMB Unreachable
192.168.1.3     00:30:1e:8b:a3:38  ICMP 137    SMB Unreachable
192.168.1.100   00:21:43:01:f7:2b  ICMP 137    SMB Unreachable
192.168.1.101   00:1e:5a:ce:0c:dc  ICMP 137    SMB Unreachable
192.168.1.30    00:02:e3:07:6a:d4  UDP  111    NFS server
192.168.1.47    00:0c:6e:74:7c:60  UDP  111    NFS client
192.168.1.1     00:1f:90:a1:43:18  ICMP 111    NFS Unreachable
192.168.1.45    78:ac:c0:44:28:7b  UDP  111    NFS client
192.168.1.3     00:30:1e:8b:a3:38  ICMP 111    NFS Unreachable
192.168.1.101   00:1e:5a:ce:0c:dc  ICMP 111    NFS Unreachable
192.168.1.100   00:21:43:01:f7:2b  ICMP 111    NFS UnreachableUnreachable and Refused mean the port was detected but the service was not detected on that machine.. There are no entries for
192.168.1.4 or 192.168.1.5 because they did not respond to any of the inquiries. The  TSTAMP   lets you check the clock on the
machines that respond.

Currently rollcall.tcz is available in the TC4, TC9, and TC10 x86 repositories.

[Rudock1]

Any chance this tool could be compiled for the Core Pure 64 repository?

I have a Dell laptop that plays by its own rules and this looks like it might shed light on some network details

nothing urgent but thanks for your consideration.

thx
Billy

[Rich]

Hi Rudock1

Any chance this tool could be compiled for the Core Pure 64 repository? ...

Absolutely. And since I don't own 64 bit hardware, you just volunteered to help. Install the following extensions:
compiletc.tcz  sstrip.tcz  squashfs-tools.tcz  submitqc.tcz
Download the attached file and execute the following commands:

Code: [Select]

tar xzvf rollcall-V0.9.tar.gz
cd rollcall-V0.9/
./CompileRollcall
./PackageRollcallVerify the program runs like this:

Code: [Select]

sudo ./rollcallIf all went well:
Copy  rollcall.tcz  and  rollcall.tcz.md5.txt  to your  tce  directory. Use the Apps utility to add  rollcall.tcz  to your onboot.lst file.
Email the  rollcall-x86_64.tar.gz.bfe  to  tcesubmit _at_ gmail _dot_ com.
You can now remove the build directory like this:

Code: [Select]

cd ..
sudo rm -rf rollcall-V0.9Any problems or questions, post them to this thread.

If anyone wishes to try this for ARM the same instructions apply but the  rollcall .tar.gz.bfe  file will have  armv  in its name.

[Rudock1]

Hi Rich,

I ran your scripts and submitted the rollcall-x86_64.tar.gz.bfe file as you instructed.  It runs well on my system and network:

Code: [Select]

[/tmp/rollcall/rollcall-V0.9]{$?=0}Sat Mar 30 10:29:37 > sudo ./rollcall
rollcall version 0.9 Apr 3, 2015
Copyright Richard A. Rost Mar 30 2019 07:23:29

Host Name=box
eth0  IP Address=192.168.1.35  Bcast=192.168.1.255  Mask=255.255.255.0

Scanning from 192.168.1.1 to 192.168.1.254 on eth0
 IP Address        Mac Address     Services
--------------------------------------------------------------------------------
192.168.1.1     a0:40:a0:79:20:ea  ARP, DHCP, PING, HTTP, DNS, TSTAMP
192.168.1.2     dc:3a:5e:be:f5:8e  ARP, PING, TSTAMP
192.168.1.3     f4:4b:2a:b4:60:92  ARP
192.168.1.4     a0:40:a0:79:34:e5  ARP, PING, HTTP, TSTAMP
192.168.1.6     a0:40:a0:79:38:5f  ARP, PING, HTTP, TSTAMP
192.168.1.35    00:24:e8:97:28:10  ARP, SSH, PING, TSTAMP
192.168.1.128   ec:f4:bb:39:95:b5  ARP, SMB, PING, TSTAMP
I really appreciate the advice and very clear directions. It was a great learning experience for me. 

I have now added "Learn how the submitqc script works." to my personal bucket list. 

thx
Billy

[Rich]

Hi Rudock1
Thank you for your help with the 64 bit version of rollcall. I forgot to ask, when you ran the  CompileRollcall  script, were there
any warning messages printed? If there were, would you please post them here?

[Juanito]

posted to CorePure64 repo

[Rich]

Hi Juanito
Thank you, and welcome back.

[Rudock1]

Hi Rudock1
Thank you for your help with the 64 bit version of rollcall. I forgot to ask, when you ran the  CompileRollcall  script, were there
any warning messages printed? If there were, would you please post them here?

Hi Rich, there were no warning messages, totally spotless.

thx
Billy