Network discovery, audit

[michalrz]

GENTLEMEN.

I got a new jerb. I inherited a medium sized (50 devices?) wired network at a military clinic.

I will be putting together my work computer tommorrow, and thought I'd start with a basic audit as a starting point for a stroll around the offices.

Would you kindly recommend a tool for Linux (I will be probably using a Debian derivative) that does most/all/some of the following:
1. discovers networks - say a NIC is connected somewhere and has some odd network configured on it,
2. discovers computers - establishes what OS is installed, what services are running (port scan), MAC, IP, SMB shares,
3. discovers devices such as routers, managed switches, networked printers,
4. finds DHCP servers,
5. is free for commercial use or has a community edition that does the above,
6. does not need any software to be installed on the above mentioned nodes,
7. can listen in for a while and detect devices that generate a lot of traffic,
8. a GUI would be nice.

Reqs 7 and 8 are least important for now.

I am currently googling around and so far have my eyes on open-audIT and zenmap.

The computers on the network are mostly Windows machines. The more info the program could gather - the better.

Thanks in advance.

 

[/dev/null]

Do you have access to the network switches/routers? openflow/netflow will tell you most of that. All you then need to do is setup a netflow collector & reporting tools.

 

[michalrz]

Do you have access to the network switches/routers? openflow/netflow will tell you most of that. All you then need to do is setup a netflow collector & reporting tools.

I do have physical access to everything.

But, would I not need to activate this on the switches themselves? Because they might be dumb switches - I have yet to check the attic of the firm and see for myself.

Thank you btw

 

[/dev/null]

Yeah Netflow is going to require a managed switch. If it's not managed you are out of luck.

 

[michalrz]

Yeah Netflow is going to require a managed switch. If it's not managed you are out of luck.

I figure I'll start with Open AudIT, Wireshark and Zenmap. Not sure about the best place to tap into, though.

Then I'll walk station to station and run LookInMyPC from a thumbdrive (free for commercial use). It's not great but should be good enough for a baseline.

If anyone has any other ideas/thoughts - feel free to chime in.