Portscanner: nmap

Recently, I wanted to list all the mac addresses of all our voip telephones (not to be confused with softphones) and reserve a block of addresses from our ip-address space and map each macaddy to an ip addy.

I already knew of nmap and I wondered how one could get all the mac addresses.

So I scanned with nmap.

I dug around on the net and bumped into this mindmap. Since I was scanning locally and not sniffing around someone else's stuff, I could get aggressive (-T5).


sudo nmap -T5 ... ip_addr_range


I wanted output I could grep, so I picked a typical output format (-oG).


sudo nmap ... -oG grepme.txt ...


I found out from the nmap man page, that nmap can do fingerprinting with the -O switch.


sudo nmap -O ip_addr_range -T5 -oG grepme.txt ...


Then I found out that the -oG option did not output the mac address. I was bummed out.

Some monkeying around I found out one could sed using multiple patterns, but that would take effort.

Update 23-07-2010: Some googling led to this command (from this blog)

First try:

nmap -T5 -sP -n ip_addr_range | tee log.txt | sed -n '1!H;${;g;s/Host \([0-9.]\+\) is up.*MAC Address: \([0-9A-F:]\+\)/\1 \2/g;p;}'

Way too greedy.

2nd try:
... still working on it...