mjhjmtu

Let's say I'm performing a discovery and mapping task in a local network for a new customer, and they have no maps nor can provide any details of their own infrastructure.

Of course I'll use configurations from their routers, switches, servers, etc to reverse what has been done for years by the lazy-sysadmin-who-had-no-time-to-write-anything-about-what-he-did-at-work.

I want to scan their local network(s) for alive hosts too, and I would do this with nmap, both relying on replies to ICMP and TCP/Syn packets. Once I get a list of alive hosts based on this, I'd like to perform some checks on each one. One of this checks would be to prove or exclude if the alive host is actually a router. Please note that a device in such case could be a router to another network, not necessarily a router to The Public Network.

If I was sure it is routing to the public network, I would script something to add a route for a known good public IP through the host beeing tested, and then try to send the packet through this route.

But this would fail in at least two cases:

• If it is forwarding packets to a non public network.


• If it is forwarding packets to the Internet, but the output is somehow filtered and my testing packet could thus be filtered in its route to or back from the Internet host.

In such situation, what would be the best way to scan for routers using Linux?

Please avoid answers based on:

• Scanning for common routers management interfaces, such as web panels, ssh ports, port banners, etc, this would fail to find any PC/Server configured (or hacked) for routing packets, and would fail if ACLs have been configured to access the router's management interfaces.


• Walking around the customer's and seeking ethernet cables around is not an option as most of the areas have access restricted or forbidden due to the type of work they do.


• Relying on what is configured on the customer's routers, Servers, PCs, as this might fail to intercept anything that was added by someone malicious, or anything put there with the intention to be hidden to the users.

-Edit #1 after @Sato's comment:

Please don't focus on the physical access to the network. The customer said that the previous sysadmin has had the ability to walk all around their sites, alone, for hours, and the contract states that I should be granted the same access level as his in order to accomplish my tasks. But in this phase of the analysis I still can't and so please imagine this as a challenge to gather all possible informations before getting physically there. I think I already know almost any information I can remotely gather from an IP network, With this question I was just wondering if there is a quick way to find if an IP device has routing enabled.