Nmap broadcast-ping NSE Script


This page contains detailed information about how to use the broadcast-ping NSE script. For list of all NSE scripts, visit the Nmap NSE Library.

Select:
Overview
Error Messages

Script Overview

Script source code: https://github.com/nmap/nmap/tree/master/scripts/broadcast-ping.nse
Script categories: discovery, safe, broadcast
Target service / protocol: -
Target network port(s): -
List of CVEs: -

Script Description

The broadcast-ping.nse script sends broadcast pings on a selected interface using raw ethernet packets and outputs the responding hosts' IP and MAC addresses or (if requested) adds them as targets. Root privileges on UNIX are required to run this script since it uses raw sockets. Most operating systems don't respond to broadcast-ping probes, but they can be configured to do so.

The interface on which is broadcasted can be specified using the -e Nmap option or the broadcast-ping.interface script-arg. If no interface is specified this script broadcasts on all ethernet interfaces which have an IPv4 address defined.

The newtarget script-arg can be used so the script adds the discovered IPs as targets.

The timeout of the ICMP probes can be specified using the timeout script-arg. The default timeout is 3000 ms. A higher number might be necessary when scanning across larger networks.

The number of sent probes can be specified using the num-probes script-arg. The default number is 1. A higher value might get more results on larger networks.

The ICMP probes sent comply with the --ttl and --data-length Nmap options, so you can use those to control the TTL(time to live) and ICMP payload length respectively. The default value for TTL is 64, and the length of the payload is 0. The payload is consisted of random bytes.

Broadcast-ping NSE Script Arguments

This is a full list of arguments supported by the broadcast-ping.nse script:

broadcast-ping.interface

String specifying which interface to use for this script (default all interfaces)

broadcast-ping.num_probes

Number specifying how many ICMP probes should be sent (default 1)

broadcast-ping.timeout

Timespec specifying how long to wait for response (default 3s)

max-newtargets

Sets the number of the maximum allowed new targets. If set to 0 or less then there is no limit. The default value is 0.

newtargets

If specified, lets NSE scripts add new targets.

- - -
To use these script arguments, add them to the Nmap command line using the --script-args arg1=value,[arg2=value,..] syntax. For example:

nmap --script=broadcast-ping --script-args broadcast-ping.interface=value,broadcast-ping.num_probes=value <target>

Broadcast-ping NSE Script Example Usage

Here's an example of how to use the broadcast-ping.nse script:

nmap -e <interface> [--ttl <ttl>] [--data-length <payload_length>]
--script broadcast-ping [--script-args [broadcast-ping.timeout=<ms>],[num-probes=<n>]]

Broadcast-ping NSE Script Example Output

Here's a sample output from the broadcast-ping.nse script:

| broadcast-ping:
|   IP: 192.168.1.1    MAC: 00:23:69:2a:b1:25
|   IP: 192.168.1.106  MAC: 1c:65:9d:88:d8:36
|_  Use --script-args=newtargets to add the results as targets

Broadcast-ping NSE Script Example XML Output

There is no sample XML output for this module. However, by providing the -oX <file> option, Nmap will produce a XML output and save it in the file.xml file.

Author

  • Gorjan Petrovski

References

See Also

Related NSE scripts to the broadcast-ping.nse script:

Visit Nmap NSE Library for more scripts.

The broadcast-ping.nse script may fail with the following error messages. Check for the possible causes by using the code snippets highlighted below found in the script source code. This can often times help in identifying the root cause of the problem.

Erroneous ICMP packet received; Cannot parse IP header.

Here is a relevant code snippet related to the "Erroneous ICMP packet received; Cannot parse IP header." error message:

199:	        -- [key = IP]=MAC
200:	        local mac_pretty = stdnse.format_mac(l2:sub(7,12))
201:	        icmp_responders[icmpreply.ip_src] = mac_pretty
202:	      end
203:	    else
204:	      stdnse.debug1("Erroneous ICMP packet received; Cannot parse IP header.")
205:	    end
206:	  end
207:	
208:	  pcap:close()
209:	  dnet:ethernet_close()

Version

This page has been created based on Nmap version 7.92.

Go back to menu.