从nmap中检索出ip和mac

neten

forward:~# nmap -sP 192.168.9.0/24

Starting Nmap 4.62 ( http://nmap.org ) at 2009-05-14 20:48 CST
Host 192.168.9.1 appears to be up.
MAC Address: 00:06:29:73:8B:F7 (IBM)
Host 192.168.9.2 appears to be up.
MAC Address: 00:1A:64:6D:06:B5 (IBM)
Host 192.168.9.3 appears to be up.
MAC Address: 00:1A:64:6D:1B:C3 (IBM)
Host 192.168.9.4 appears to be up.
MAC Address: 00:191:32:BF:CE (Intel)
Host 192.168.9.7 appears to be up.
MAC Address: 00:22:15:85:E2:A6 (Unknown)
Host forward.cyjt.com.cn (192.168.9.9) appears to be up.
Host 192.168.9.10 appears to be up.
MAC Address: 00:40:05:43:02:6D (ANI Communications)
Host 192.168.9.79 appears to be up.
MAC Address: 00:22:15:8E:CC:77 (Unknown)
Host 192.168.9.94 appears to be up.
MAC Address: 00:1E:68:35:64:9E (Quanta Computer)
Host 192.168.9.115 appears to be up.
MAC Address: 00:24:8C:29:CB:F8 (Unknown)
Host 192.168.9.117 appears to be up.
MAC Address: 00:23:54:15:52:9D (Unknown)
Host 192.168.9.122 appears to be up.
MAC Address: 00:1F:16:10D:A7 (Wistron)
如何得到形如：
192.168.9.122  00:1F:16:10D:A7
192.168.9.117   00:23:54:15:52:9D
......
谢谢！

neten

1. nmap -sP 192.168.9.0/24|grep -v '^[Starting|Nmap]'|awk 'BEGIN{RS=")"} {print $2"\t"$9}'

复制代码

这样好似会有问题。

neten

期待更好答案！

vbs100

有些机子不回复icmp 可以在其它的地方开个tcpdump
sudo tcpdump -ntp arp | grep reply
这样回复arp的机子都认为是在线的

steel_lei

[root@rhel5 ~]# nmap -sP 192.168.1.0/24 | grep -B 1 "MAC" | sed '/--/d' | awk '{if(NR%2==1){print $2}if(NR%2==0){print $3}}' | xargs -n2
192.168.1.1 00:1E:2A:60:AA:12
192.168.1.43 00:0C:29:56:BA:40
192.168.1.56 00:1D:0F:04:67:50
192.168.1.68 00:1D:0F:07:C5:0F

neten

好似巨慢。

neten

原帖由 steel_lei 于 2009-5-14 21:40 发表
[root@rhel5 ~]# nmap -sP 192.168.1.0/24 | grep -B 1 "MAC" | sed '/--/d' | awk '{if(NR%2==1){print $2}if(NR%2==0){print $3}}' | xargs -n2
192.168.1.1 00:1E:2A:60:AA:12
192.168.1.43 00:0C:29:56:B ...

这个可以，谢了。

steel_lei

原帖由 neten 于 2009-5-14 21:41 发表
好似巨慢。

不好意思，发错

[ 本帖最后由 steel_lei 于 2009-5-14 21:51 编辑 ]

vbs100

nmap -sP 192.168.1.0/24 | awk '$1 ~ /MAC/ {print $2;getline;print $2}
不过顺序好像反了

neten

有问题吧：kde:/mnt/sda9# nmap -sP 192.168.9.0/24 | awk '$1 ~ /MAC/ {print $2;getline;print $2}'

Address:
192.168.9.201
Address:
192.168.9.248
Address:
192.168.9.250
Address:
192.168.9.252
Address:
done: