nmap to awk to sed. is there a better way?

Clash Royale CLAN TAG#URR8PPP
up vote
4
down vote
favorite
I have a project where I know a single computer and a single printer will be the only things on the network. What I want to do is detect when the printer is connected to the network. I also know that the computer is 192.168.3.1. However, with DHCP I won't know the printer address (yes, it could be made static to make it easier but, 'they' don't like that. 'They' want it dynamic)
What I have is a script that does the following and it works.
nmap -sP 192.168.3.0/24
| awk '/192.168.3/ && !/192.168.3.1$/'
| sed 's/Nmap scan report for //'
Nmap output
Nmap scan report for 192.168.3.1
Host is up (0.014s latency).
Nmap scan report for 192.168.3.100
Host is up (0.012s latency).
Nmap done: 256 IP addresses (2 hosts up) scanned in 2.54 seconds
Script output
192.168.3.100
It only takes a couple seconds to work but is there a better/cleaner/faster way?
awk dhcp nmap
add a comment |Â
up vote
4
down vote
favorite
I have a project where I know a single computer and a single printer will be the only things on the network. What I want to do is detect when the printer is connected to the network. I also know that the computer is 192.168.3.1. However, with DHCP I won't know the printer address (yes, it could be made static to make it easier but, 'they' don't like that. 'They' want it dynamic)
What I have is a script that does the following and it works.
nmap -sP 192.168.3.0/24
| awk '/192.168.3/ && !/192.168.3.1$/'
| sed 's/Nmap scan report for //'
Nmap output
Nmap scan report for 192.168.3.1
Host is up (0.014s latency).
Nmap scan report for 192.168.3.100
Host is up (0.012s latency).
Nmap done: 256 IP addresses (2 hosts up) scanned in 2.54 seconds
Script output
192.168.3.100
It only takes a couple seconds to work but is there a better/cleaner/faster way?
awk dhcp nmap
8
Piping awk to sed is redundant; awk does both jobs. Paste the output you are working with and the desired result.
â jasonwryan
Apr 11 at 21:31
add a comment |Â
up vote
4
down vote
favorite
up vote
4
down vote
favorite
I have a project where I know a single computer and a single printer will be the only things on the network. What I want to do is detect when the printer is connected to the network. I also know that the computer is 192.168.3.1. However, with DHCP I won't know the printer address (yes, it could be made static to make it easier but, 'they' don't like that. 'They' want it dynamic)
What I have is a script that does the following and it works.
nmap -sP 192.168.3.0/24
| awk '/192.168.3/ && !/192.168.3.1$/'
| sed 's/Nmap scan report for //'
Nmap output
Nmap scan report for 192.168.3.1
Host is up (0.014s latency).
Nmap scan report for 192.168.3.100
Host is up (0.012s latency).
Nmap done: 256 IP addresses (2 hosts up) scanned in 2.54 seconds
Script output
192.168.3.100
It only takes a couple seconds to work but is there a better/cleaner/faster way?
awk dhcp nmap
I have a project where I know a single computer and a single printer will be the only things on the network. What I want to do is detect when the printer is connected to the network. I also know that the computer is 192.168.3.1. However, with DHCP I won't know the printer address (yes, it could be made static to make it easier but, 'they' don't like that. 'They' want it dynamic)
What I have is a script that does the following and it works.
nmap -sP 192.168.3.0/24
| awk '/192.168.3/ && !/192.168.3.1$/'
| sed 's/Nmap scan report for //'
Nmap output
Nmap scan report for 192.168.3.1
Host is up (0.014s latency).
Nmap scan report for 192.168.3.100
Host is up (0.012s latency).
Nmap done: 256 IP addresses (2 hosts up) scanned in 2.54 seconds
Script output
192.168.3.100
It only takes a couple seconds to work but is there a better/cleaner/faster way?
awk dhcp nmap
edited Apr 12 at 13:26
Yaron
3,19421027
3,19421027
asked Apr 11 at 21:27
Mike Kangas
234
234
8
Piping awk to sed is redundant; awk does both jobs. Paste the output you are working with and the desired result.
â jasonwryan
Apr 11 at 21:31
add a comment |Â
8
Piping awk to sed is redundant; awk does both jobs. Paste the output you are working with and the desired result.
â jasonwryan
Apr 11 at 21:31
8
8
Piping awk to sed is redundant; awk does both jobs. Paste the output you are working with and the desired result.
â jasonwryan
Apr 11 at 21:31
Piping awk to sed is redundant; awk does both jobs. Paste the output you are working with and the desired result.
â jasonwryan
Apr 11 at 21:31
add a comment |Â
4 Answers
4
active
oldest
votes
up vote
8
down vote
accepted
There's no need to scan the entire subnet if you know that you're not interested in part of it. (Avoiding the computer means you don't need to discard its result.)
nmap -oG - -sn 192.168.3.2-254 | awk '$NF=="Up" print $2'
or if you prefer using the XML output instead of the grep output
nmap -oX - -sP 192.168.3.2-254 | xmlstarlet sel -t -m '//address[@addrtype="ipv4"]' -v '@addr' -n
Use -sP instead of the newer -sn if your version of nmap requires it.
Incidentally, although your system administrators may want you to have your printer on DHCP, there should be little reason why they can't arrange for it to have a known unchanging address. (I do that for printers on my networks so that printer software doesn't need to worry about IP addresses changing unexpectedly.) Sometimes this is known as a "sticky" address, to differentiate it from a static (non-DHCP) address or a pseudo-random dynamic (DHCP) address.
Are you sure the DHCP server itself won't be on your subnet? Otherwise, how is your printer going to get its dynamic address?
in this case it's not administrators. the computer is a raspberry pi and is also the hotspot and dns server. eth0 is setup as dhcp to whatever gets plugged in. in this case the Pi is being rented and if the customer doesn't want to rent a printer they may buy one of their own of the same model. in this case, they would only be required to know how to plug in the eth cable and the Pi would find the 1 address on the subnet that is not itself.
â Mike Kangas
Apr 12 at 22:56
@MikeKangas ah! Then if there's only going to be one device on your subnet, allow your DHCP server to offer only one lease. Make it short enough that a printer swap-over won't crash and burn (maybe 10 minutes) and then you've got a fixed known IP address for "any" printer the customer cares to attach.
â roaima
Apr 12 at 22:59
OOOH! I have about 1 month of total linux experience and doing something like that never crossed my mind!!! huge huge thanks!!
â Mike Kangas
Apr 13 at 0:13
1
i found the dnsmasq dhcp-range and turned it to 192.168.3.100,192.168.3.100 and then updated my nmap to only look for that IP. my nmap scan time went from 2.34 seconds to 0.02 seconds. thank you, thank you, thank you.
â Mike Kangas
Apr 13 at 2:24
add a comment |Â
up vote
11
down vote
You can accomplish this with the following awk command:
nmap -sP 192.168.3.0/24
| awk '/192.168.3/ && !/192.168.3.1$/print $NF'
This is telling awk to print the last field of the matched line(s)
add a comment |Â
up vote
3
down vote
Perhaps an even more efficient solution using only grep (requires GNU grep or a grep that supports perl regex):
nmap -sP 192.168.3.0/24
| grep -o -P '192.168.3.(?!1$)[0-9]+'
This is greping for -o (only) the IP address matching any IP beginning with 192.168.3 except for 192.168.3.1
add a comment |Â
up vote
0
down vote
Once you have the IP address for the printer you can then get the host name with nmblookup -A 'IP address'. This should help in the future if the IP changes since you'll be asking the network for a machine with this name vs trying to find a machine by IP address.
add a comment |Â
4 Answers
4
active
oldest
votes
4 Answers
4
active
oldest
votes
active
oldest
votes
active
oldest
votes
up vote
8
down vote
accepted
There's no need to scan the entire subnet if you know that you're not interested in part of it. (Avoiding the computer means you don't need to discard its result.)
nmap -oG - -sn 192.168.3.2-254 | awk '$NF=="Up" print $2'
or if you prefer using the XML output instead of the grep output
nmap -oX - -sP 192.168.3.2-254 | xmlstarlet sel -t -m '//address[@addrtype="ipv4"]' -v '@addr' -n
Use -sP instead of the newer -sn if your version of nmap requires it.
Incidentally, although your system administrators may want you to have your printer on DHCP, there should be little reason why they can't arrange for it to have a known unchanging address. (I do that for printers on my networks so that printer software doesn't need to worry about IP addresses changing unexpectedly.) Sometimes this is known as a "sticky" address, to differentiate it from a static (non-DHCP) address or a pseudo-random dynamic (DHCP) address.
Are you sure the DHCP server itself won't be on your subnet? Otherwise, how is your printer going to get its dynamic address?
in this case it's not administrators. the computer is a raspberry pi and is also the hotspot and dns server. eth0 is setup as dhcp to whatever gets plugged in. in this case the Pi is being rented and if the customer doesn't want to rent a printer they may buy one of their own of the same model. in this case, they would only be required to know how to plug in the eth cable and the Pi would find the 1 address on the subnet that is not itself.
â Mike Kangas
Apr 12 at 22:56
@MikeKangas ah! Then if there's only going to be one device on your subnet, allow your DHCP server to offer only one lease. Make it short enough that a printer swap-over won't crash and burn (maybe 10 minutes) and then you've got a fixed known IP address for "any" printer the customer cares to attach.
â roaima
Apr 12 at 22:59
OOOH! I have about 1 month of total linux experience and doing something like that never crossed my mind!!! huge huge thanks!!
â Mike Kangas
Apr 13 at 0:13
1
i found the dnsmasq dhcp-range and turned it to 192.168.3.100,192.168.3.100 and then updated my nmap to only look for that IP. my nmap scan time went from 2.34 seconds to 0.02 seconds. thank you, thank you, thank you.
â Mike Kangas
Apr 13 at 2:24
add a comment |Â
up vote
8
down vote
accepted
There's no need to scan the entire subnet if you know that you're not interested in part of it. (Avoiding the computer means you don't need to discard its result.)
nmap -oG - -sn 192.168.3.2-254 | awk '$NF=="Up" print $2'
or if you prefer using the XML output instead of the grep output
nmap -oX - -sP 192.168.3.2-254 | xmlstarlet sel -t -m '//address[@addrtype="ipv4"]' -v '@addr' -n
Use -sP instead of the newer -sn if your version of nmap requires it.
Incidentally, although your system administrators may want you to have your printer on DHCP, there should be little reason why they can't arrange for it to have a known unchanging address. (I do that for printers on my networks so that printer software doesn't need to worry about IP addresses changing unexpectedly.) Sometimes this is known as a "sticky" address, to differentiate it from a static (non-DHCP) address or a pseudo-random dynamic (DHCP) address.
Are you sure the DHCP server itself won't be on your subnet? Otherwise, how is your printer going to get its dynamic address?
in this case it's not administrators. the computer is a raspberry pi and is also the hotspot and dns server. eth0 is setup as dhcp to whatever gets plugged in. in this case the Pi is being rented and if the customer doesn't want to rent a printer they may buy one of their own of the same model. in this case, they would only be required to know how to plug in the eth cable and the Pi would find the 1 address on the subnet that is not itself.
â Mike Kangas
Apr 12 at 22:56
@MikeKangas ah! Then if there's only going to be one device on your subnet, allow your DHCP server to offer only one lease. Make it short enough that a printer swap-over won't crash and burn (maybe 10 minutes) and then you've got a fixed known IP address for "any" printer the customer cares to attach.
â roaima
Apr 12 at 22:59
OOOH! I have about 1 month of total linux experience and doing something like that never crossed my mind!!! huge huge thanks!!
â Mike Kangas
Apr 13 at 0:13
1
i found the dnsmasq dhcp-range and turned it to 192.168.3.100,192.168.3.100 and then updated my nmap to only look for that IP. my nmap scan time went from 2.34 seconds to 0.02 seconds. thank you, thank you, thank you.
â Mike Kangas
Apr 13 at 2:24
add a comment |Â
up vote
8
down vote
accepted
up vote
8
down vote
accepted
There's no need to scan the entire subnet if you know that you're not interested in part of it. (Avoiding the computer means you don't need to discard its result.)
nmap -oG - -sn 192.168.3.2-254 | awk '$NF=="Up" print $2'
or if you prefer using the XML output instead of the grep output
nmap -oX - -sP 192.168.3.2-254 | xmlstarlet sel -t -m '//address[@addrtype="ipv4"]' -v '@addr' -n
Use -sP instead of the newer -sn if your version of nmap requires it.
Incidentally, although your system administrators may want you to have your printer on DHCP, there should be little reason why they can't arrange for it to have a known unchanging address. (I do that for printers on my networks so that printer software doesn't need to worry about IP addresses changing unexpectedly.) Sometimes this is known as a "sticky" address, to differentiate it from a static (non-DHCP) address or a pseudo-random dynamic (DHCP) address.
Are you sure the DHCP server itself won't be on your subnet? Otherwise, how is your printer going to get its dynamic address?
There's no need to scan the entire subnet if you know that you're not interested in part of it. (Avoiding the computer means you don't need to discard its result.)
nmap -oG - -sn 192.168.3.2-254 | awk '$NF=="Up" print $2'
or if you prefer using the XML output instead of the grep output
nmap -oX - -sP 192.168.3.2-254 | xmlstarlet sel -t -m '//address[@addrtype="ipv4"]' -v '@addr' -n
Use -sP instead of the newer -sn if your version of nmap requires it.
Incidentally, although your system administrators may want you to have your printer on DHCP, there should be little reason why they can't arrange for it to have a known unchanging address. (I do that for printers on my networks so that printer software doesn't need to worry about IP addresses changing unexpectedly.) Sometimes this is known as a "sticky" address, to differentiate it from a static (non-DHCP) address or a pseudo-random dynamic (DHCP) address.
Are you sure the DHCP server itself won't be on your subnet? Otherwise, how is your printer going to get its dynamic address?
edited Apr 11 at 22:28
answered Apr 11 at 22:10
roaima
39.4k545106
39.4k545106
in this case it's not administrators. the computer is a raspberry pi and is also the hotspot and dns server. eth0 is setup as dhcp to whatever gets plugged in. in this case the Pi is being rented and if the customer doesn't want to rent a printer they may buy one of their own of the same model. in this case, they would only be required to know how to plug in the eth cable and the Pi would find the 1 address on the subnet that is not itself.
â Mike Kangas
Apr 12 at 22:56
@MikeKangas ah! Then if there's only going to be one device on your subnet, allow your DHCP server to offer only one lease. Make it short enough that a printer swap-over won't crash and burn (maybe 10 minutes) and then you've got a fixed known IP address for "any" printer the customer cares to attach.
â roaima
Apr 12 at 22:59
OOOH! I have about 1 month of total linux experience and doing something like that never crossed my mind!!! huge huge thanks!!
â Mike Kangas
Apr 13 at 0:13
1
i found the dnsmasq dhcp-range and turned it to 192.168.3.100,192.168.3.100 and then updated my nmap to only look for that IP. my nmap scan time went from 2.34 seconds to 0.02 seconds. thank you, thank you, thank you.
â Mike Kangas
Apr 13 at 2:24
add a comment |Â
in this case it's not administrators. the computer is a raspberry pi and is also the hotspot and dns server. eth0 is setup as dhcp to whatever gets plugged in. in this case the Pi is being rented and if the customer doesn't want to rent a printer they may buy one of their own of the same model. in this case, they would only be required to know how to plug in the eth cable and the Pi would find the 1 address on the subnet that is not itself.
â Mike Kangas
Apr 12 at 22:56
@MikeKangas ah! Then if there's only going to be one device on your subnet, allow your DHCP server to offer only one lease. Make it short enough that a printer swap-over won't crash and burn (maybe 10 minutes) and then you've got a fixed known IP address for "any" printer the customer cares to attach.
â roaima
Apr 12 at 22:59
OOOH! I have about 1 month of total linux experience and doing something like that never crossed my mind!!! huge huge thanks!!
â Mike Kangas
Apr 13 at 0:13
1
i found the dnsmasq dhcp-range and turned it to 192.168.3.100,192.168.3.100 and then updated my nmap to only look for that IP. my nmap scan time went from 2.34 seconds to 0.02 seconds. thank you, thank you, thank you.
â Mike Kangas
Apr 13 at 2:24
in this case it's not administrators. the computer is a raspberry pi and is also the hotspot and dns server. eth0 is setup as dhcp to whatever gets plugged in. in this case the Pi is being rented and if the customer doesn't want to rent a printer they may buy one of their own of the same model. in this case, they would only be required to know how to plug in the eth cable and the Pi would find the 1 address on the subnet that is not itself.
â Mike Kangas
Apr 12 at 22:56
in this case it's not administrators. the computer is a raspberry pi and is also the hotspot and dns server. eth0 is setup as dhcp to whatever gets plugged in. in this case the Pi is being rented and if the customer doesn't want to rent a printer they may buy one of their own of the same model. in this case, they would only be required to know how to plug in the eth cable and the Pi would find the 1 address on the subnet that is not itself.
â Mike Kangas
Apr 12 at 22:56
@MikeKangas ah! Then if there's only going to be one device on your subnet, allow your DHCP server to offer only one lease. Make it short enough that a printer swap-over won't crash and burn (maybe 10 minutes) and then you've got a fixed known IP address for "any" printer the customer cares to attach.
â roaima
Apr 12 at 22:59
@MikeKangas ah! Then if there's only going to be one device on your subnet, allow your DHCP server to offer only one lease. Make it short enough that a printer swap-over won't crash and burn (maybe 10 minutes) and then you've got a fixed known IP address for "any" printer the customer cares to attach.
â roaima
Apr 12 at 22:59
OOOH! I have about 1 month of total linux experience and doing something like that never crossed my mind!!! huge huge thanks!!
â Mike Kangas
Apr 13 at 0:13
OOOH! I have about 1 month of total linux experience and doing something like that never crossed my mind!!! huge huge thanks!!
â Mike Kangas
Apr 13 at 0:13
1
1
i found the dnsmasq dhcp-range and turned it to 192.168.3.100,192.168.3.100 and then updated my nmap to only look for that IP. my nmap scan time went from 2.34 seconds to 0.02 seconds. thank you, thank you, thank you.
â Mike Kangas
Apr 13 at 2:24
i found the dnsmasq dhcp-range and turned it to 192.168.3.100,192.168.3.100 and then updated my nmap to only look for that IP. my nmap scan time went from 2.34 seconds to 0.02 seconds. thank you, thank you, thank you.
â Mike Kangas
Apr 13 at 2:24
add a comment |Â
up vote
11
down vote
You can accomplish this with the following awk command:
nmap -sP 192.168.3.0/24
| awk '/192.168.3/ && !/192.168.3.1$/print $NF'
This is telling awk to print the last field of the matched line(s)
add a comment |Â
up vote
11
down vote
You can accomplish this with the following awk command:
nmap -sP 192.168.3.0/24
| awk '/192.168.3/ && !/192.168.3.1$/print $NF'
This is telling awk to print the last field of the matched line(s)
add a comment |Â
up vote
11
down vote
up vote
11
down vote
You can accomplish this with the following awk command:
nmap -sP 192.168.3.0/24
| awk '/192.168.3/ && !/192.168.3.1$/print $NF'
This is telling awk to print the last field of the matched line(s)
You can accomplish this with the following awk command:
nmap -sP 192.168.3.0/24
| awk '/192.168.3/ && !/192.168.3.1$/print $NF'
This is telling awk to print the last field of the matched line(s)
answered Apr 11 at 21:44
Jesse_b
10.4k22658
10.4k22658
add a comment |Â
add a comment |Â
up vote
3
down vote
Perhaps an even more efficient solution using only grep (requires GNU grep or a grep that supports perl regex):
nmap -sP 192.168.3.0/24
| grep -o -P '192.168.3.(?!1$)[0-9]+'
This is greping for -o (only) the IP address matching any IP beginning with 192.168.3 except for 192.168.3.1
add a comment |Â
up vote
3
down vote
Perhaps an even more efficient solution using only grep (requires GNU grep or a grep that supports perl regex):
nmap -sP 192.168.3.0/24
| grep -o -P '192.168.3.(?!1$)[0-9]+'
This is greping for -o (only) the IP address matching any IP beginning with 192.168.3 except for 192.168.3.1
add a comment |Â
up vote
3
down vote
up vote
3
down vote
Perhaps an even more efficient solution using only grep (requires GNU grep or a grep that supports perl regex):
nmap -sP 192.168.3.0/24
| grep -o -P '192.168.3.(?!1$)[0-9]+'
This is greping for -o (only) the IP address matching any IP beginning with 192.168.3 except for 192.168.3.1
Perhaps an even more efficient solution using only grep (requires GNU grep or a grep that supports perl regex):
nmap -sP 192.168.3.0/24
| grep -o -P '192.168.3.(?!1$)[0-9]+'
This is greping for -o (only) the IP address matching any IP beginning with 192.168.3 except for 192.168.3.1
answered Apr 11 at 22:00
Jesse_b
10.4k22658
10.4k22658
add a comment |Â
add a comment |Â
up vote
0
down vote
Once you have the IP address for the printer you can then get the host name with nmblookup -A 'IP address'. This should help in the future if the IP changes since you'll be asking the network for a machine with this name vs trying to find a machine by IP address.
add a comment |Â
up vote
0
down vote
Once you have the IP address for the printer you can then get the host name with nmblookup -A 'IP address'. This should help in the future if the IP changes since you'll be asking the network for a machine with this name vs trying to find a machine by IP address.
add a comment |Â
up vote
0
down vote
up vote
0
down vote
Once you have the IP address for the printer you can then get the host name with nmblookup -A 'IP address'. This should help in the future if the IP changes since you'll be asking the network for a machine with this name vs trying to find a machine by IP address.
Once you have the IP address for the printer you can then get the host name with nmblookup -A 'IP address'. This should help in the future if the IP changes since you'll be asking the network for a machine with this name vs trying to find a machine by IP address.
answered Apr 12 at 13:29
Keith Bux
11
11
add a comment |Â
add a comment |Â
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f437146%2fnmap-to-awk-to-sed-is-there-a-better-way%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
8
Piping awk to sed is redundant; awk does both jobs. Paste the output you are working with and the desired result.
â jasonwryan
Apr 11 at 21:31