Scanning Network by IP Address Range

Very often, especially if your network does not have properly configured DNS and WINS, it may be difficult to view network neighborhood. The scanning network by IP addresses feature allows retrieving the list of all available hosts.

You can use IP range scanning for detection hosts with certain service running (certain TCP port opened). For example, you can find all FTP servers in your network by setting field Port to 21 (the same for HTTP - 80).

Note: This function is firewall dependent. You must setup your firewall so LANState could scan TCP ports of other hosts.

The function Edit | Import hosts | Scan IP address range duplicates the function Search new hosts which is described in detail here.

The IP address scanning function is built upon the same routine as Network Map Creation Wizard. It is based upon the multi-threaded polling of all possible IP addresses within specified ranges. To each IP address, the program sends a set of standard network queries, replies to which indicate that a device with such IP address is present in the network. Such queries include:

• Sending an ICMP packet (ping).
• Scanning the list of TCP ports.
• Trying to get a host's MAC address (ARP ping).
• Connecting to SNMP agent.

The polling routine runs through a number of simultaneous threads, which speeds up the search sufficiently.

To search for new devices, on the main menu select Service | Search New Hosts or Edit | Import hosts | Scan IP address range.... The search window (Fig. 1) contains 4 tabs.

In the Starting IP address and Ending IP address fields on the first tab, enter the network scanning range. When you click on the arrow button,  the starting address field value will be copied to the ending address field; that speeds up entering IP range values. By default, these fields will automatically have the IP range with your computer's IP address (calculated automatically by the net mask value). You can set a different IP range automatically by selecting a different interface from the corresponding lit. Move the range you have defined here to the routine by clicking on the Add -> button. To remove a range from the list, simply click on the Delete button. Please note that the program will process only the ranges you have ticked off.

Fig. 1: The IP range scanning window (configuring IP address ranges).

On the second tab (Fig. 2) you can set scanning parameters. Select the required network polling methods. Keep in mind that the more methods you select, the more devices can be found. However, that will increase the scanning time. The same applies to the number of TCP ports to be scanned and the number of ICMP packets. The data from the Community string field is necessary for finding and retrieving data from SNMP devices (network printers, switches, etc.) The most common Community string values are: public, private, rmon .

For all types of queries, you can set a custom Response timeout for the address to be polled. Enabling the Search only new devices parameter allows keeping an eye on new and unauthorized devices attempting to connect to your network. To ensure that the function runs well in this mode, scan the network once with this parameter disabled. After the program has found all devices within the specified range, place their addresses to the List of allowed IP addresses (Fig. 3). Then enable the Search only new devices parameter, and the program will notify you of new active devices with addresses outside of this list (see the Notifications tab). You can loop the scanning process by specifying the automatic scan restart period (the Scan constantly, in NN sec. parameter.) The parameter Maximum number of threads sets the number of search threads that will simultaneously scan the specified IP ranges. The more threads you set, the faster the scanning will go. However, a too large number of threads can significantly drop the overall performance of your system. It is recommended that you use the default values. The greatest allowed number of threads is 100.

If you want the program to draw connection links for new found devices, select the Draw connection links using information from switches when adding new devices to the map setting and configure IP addresses of switches that can contain this data. If the connection information cannot be retrieved, the lines will not be drawn.

Fig. 2: The IP range scanning window (configuring scanning parameters).

The third tab (Fig. 3) contains the List of allowed IP addresses. It can be compiled both by hand and automatically, by importing the data from an earlier created map or from the search results list (Fig. 4). When the program searches for new hosts, it checks whether the list of allowed addresses contains each newly found host. If the host does not belong to the list, the program will add it to the results tab.

This list also allows the program to find unauthorized computers connected to your network. If someone changes his IP address, the program will also detect this. In order to do this, you need to add all known hosts to the list of allowed addresses. Add IP and MAC addresses of the hosts to the list and select the Search only new devices option on the previous tab. The program will compare found addresses with the allowed addresses. If a new address is detected, the program will show a message. If you want to monitor and find new computers in your network only, you need to specify MAC or IP address for each host. If you want to monitor IP address changes, please specify IP and MAC addresses both.

The list of IP addresses can be saved to a file, or loaded from a file.

Fig. 3: The IP range scanning window (configuring allowed IP addresses).

Scanning results are displayed on the next tab of the window (Fig. 4). To place the found devices on the map, select them and click the Add to map button. If necessary, you can chop off DNS suffixes of computer names when placing those on the map (select the parameter Cut DNS suffix...). You can also choose to add only new devices on the map you have created (i.e. only those that are not currently on the map). This makes it easier to maintain the actuality of maps of rapid-growing, large networks. To enable this option, simply tick off the parameter Add new hosts only. When scanning network automatically in background mode, newly detected devices will be just placed on map automatically if you select the Place on map automatically setting. You can select what to use as hosts' addresses - DNS names or IP addresses.

Fig. 4: The IP range scanning window (scanning results).

The search process can be stopped before the completion by clicking on the Stop button.

The Logic of Adding New Hosts to Map
When the program finds a new host it assigns a network address to the host according to the Use DNS name as host address and Cut DNS suffix before adding to map options. For example, the address will be "192.168.1.1", or "mypcname.dnszone.dom", or "mypcname". After forming the address, the program will search for it among hosts on the current map. If the address is not found, the host will be considered as new and it will be added to the map. Please note that the program will not consider the "mypcname.dnszone.dom" and "mypcname" addresses as equal. I.e., if you used addresses with DNS suffixes when the map was created, but then you selected the Cut DNS suffix before adding to map option when the program searched for new devices, the hosts are added to the map one more time (without DNS suffixes on this time).

Detecting New Hosts and Alerting About That

On the Notifications tab, you can configure actions to be taken when the program detects new hosts on your network. This will be done only if the Search only new devices parameter is enabled on the Scanning settings tab. The hosts that are not listed on the List of allowed addresses tab will be considered as new and the program will notify you about them. The notification methods include: displaying a screen message, sending e-mail, writing to the program log, playing a sound. Select necessary options how you would like to be notified about the new hosts.

Fig. 5: The IP range scanning window (notifications about new hosts).

The Message text can also be configured on this tab. You can use Keys that described on the window and the program will substitute the keys with appropriate values in the message text when it is displayed (or sent, or written).

To send the scanning to background, hit on the Esc key or click on the Background button. At the same time, the toolbar of the main window of the program will display the button with the scanning progress displayed in its caption. Clicking on that button will bring the scanning process back to the window mode. If you select the Background mode and then minimize the program to tray, when the scanning is complete or when a new device is found, you will be notified with a sound, a message and a bubble tip by the program's icon in the tray.

To keep an eye on the security of the network constantly and automatically, select the parameter Start search in background on the program startup. In this case, the specified IP ranges will be scanned automatically every time the program is run. The scanning window will be minimized, and to restore it, you would have to either select the corresponding items on the menu or click on the above described button on the toolbar.

You can copy scanning results to clipboard and then paste them to any text file or a Microsoft Excel worksheet. For that purpose, open the context menu over the resource list and then select the Copy to clipboard item.