Duplicate IP Address Scanning

Duplicate IP addresses sometimes occur on an IPv4 network subnet if a device is added that already has a static IP address assigned to it. Operating systems like Windows can detect this, but this detection normally happens when the OS is starting up. If a duplicate occurs, ARP reply packets return to a sender (who send ARP discovery) from two sources, both with the same IP but with different MAC addresses. We have a tool in NetScanTools Pro that can scan your whole subnet and look for duplicate IP responses. It will show the MAC address, Interface Manufacturer and Hostname of the duplicate devices.

Here is an example of what happens when a duplicate is found:

Demonstration Video:



This tool is quick and easy to use, you simply enter the IP address range, select the WinPcap compatible interface that is found in the IP address range and start it. If you have a large range like a 10.x.x.x, it may take a long time to complete and I would suggest breaking the range up into ranges where you know devices exist.

To learn more about the Duplicate IP Address Scanner tool and to download a demo with this tool fully active, please visit this page NetScanTools.com

IPv6 Link Local Addressing

As I've been working to adding IPv6 capabilities to NetScanTools Pro. As I have worked with link local addressing I have learn some interesting things. In the IPv4 world if you want to ping an address or connect to a computer on your local network, the software can easily find out the best interface (if you have more than one) to send packets out of to the other computer - all you had to do was supply the IP address. It does this using routing tables and ARP.

In IPv6, it's not quite so easy. In Windows or any other OS, you will often have two or more interfaces capable of talking IPv6. Since all link local addresses begin with FE80:, there is no method for saying this one address is on this segment and this one is on that segment like there is in IPv4 (by using IP address and subnet mask).

Essentially you have to tell the software you are using which interface to use to get to the link local address. If you have one interface to your switch and all the other devices are on the same VLAN, then it's pretty easy. You do this by appending a %# where # is the IPv6 interface number in Windows - also called the Scope ID. In unix derived operating systems like Ubuntu or OS X Lion, you would use %eth0 for the main interface.

How do you know which interface to use? That's where you have to know your network. In my case, this particular XP machine assigns '6' as the Scope ID - you can see this using ipconfig /all. It could be any number, but it's usually a single digit. So to ping an IPv6 address you would enter smoething lik "ping -6 FE80::3CC0:1%6" on the command line (no quotes). Or if you were using NetScanTools Pro v11 Ping Enhanced you would enter FE80::3CC0:1%6 as the target. If you leave off the %6 or change it to another number the software will not know which interface to send the packets out of. In NetScanTools Pro, you will see an error message. The command line ping will tell you the net is unreachable if you use the wrong Scope ID.

Just a few things I've learned about IPv6 link local addressing.

NetScanTools Pro 10.98.2 Released

On February 23, 2011 we released NetScanTools Pro 10.98.2 both installed and USB versions. Many of the changes have to do with privileges and will primarily affect Windows 7 and Vista users.

Here are the release notes.
-Improved messages that show if writing to a registry location fails. They now suggest escalating the privileges by starting the program with 'Run as administrator'.
-All temporary snmp files are now removed on program exit.
-Improved handling of WinPcap interfaces where both IPv4 and IPv6 addresses are bound to the interface. Affects several programs.
-Internal changes to DNS Tools resolver.
-Port Scanner and NetScanner (Ping Scan) now show warning messages if privileges are not sufficient to run UDP scan and Subnet Mask test respectively.
-Updated SQLite to version 3.7.4.
-Updated database files.

Enjoy!

XP IPv6 Weirdness

This article is about a computer that has IPv6 installed on Windows XP SP3.

I was using Wireshark today checking on the operation of the NetScanTools Pro v11 port scanner when I noticed something weird. Every 10 seconds a set of regularly spaced AAAA record queries were going to my ISPs DNS (default DNS for this system). The AAAA queries were all for 'mycomputername.domain.actdsltmp' and each time the DNS would respond back with 'no such name'. So I started closing down the browser and all the open programs - no change, the queries continued. Since this amounts to DNS harassment and a waste of bandwidth, I decided to find the cause. The 'domain.actdsltmp' part of the request is there because we have an Actiontec GT701 that provides that to my computer as a default domain name.

I could not find a way to shut it off short of uninstalling IPv6, so I did a nice workaround that works well. I added these two records to my hosts file using NetScanTools Pro - you can use something else if you want, it's just a text file. The first record is for IPv4 and the second for IPv6:

127.0.0.1 mycomputername.domain.actdsltmp
::1 mycomputername.domain.actdsltmp

The purpose of those records is to intercept outgoing DNS queries before they happen. This is because Windows DNS queries start with the hosts file, then failing to find the mapping in there, the actual outgoing DNS query is made to the default system DNSs.

Those two records tell whatever is asking for those hostnames that the loopback addresses (IPv4 and IPv6) are the addresses to use. This makes sense anyway because it's asking for a translation of your own computer name.

IPv6 eliminating NAT

I just saw an IPv6 tweet where the guy said he set up IPv6 DNS entries for all his home machines. He can now connect to them directly from his office to any home machine. He was happy to eliminate NAT.

I realize that you don't need NAT when your computers can all have their own IPv6 address - but NAT does provide some safety - think about it:

Now anyone knowing those IPv6s can contact (hack) his machines that are now sitting directly on the internet. Kind of like going back to the mid 1990s. IPv4 NAT was keeping him safe from alot of hazardous traffic that will now hit each PC directly...

Kirk

NetScanTools Pro 11 status

Another week has passed. This week included quite a bit of work on version 11 - again in the area of IPv6. NSLOOKUP and Dig both now accept IPv6 address inputs.

Most importantly, whois now accepts IPv6 inputs. Whois' ip to hostname to ip now work with IPv6. So if you enter a domain name, it will check for both IPv4 and IPv6 addresses. Plus, the whois servers for showing ownership or delegation of the IPv6 addresses are now in the database and it will make the correct query based on the input IPv6 address.

A few more new things next week and then wrap up for release.

Kirk