Skip to content

Instantly share code, notes, and snippets.

Show Gist options
  • Save snorfsneflin/c4a5a99dc25385031565 to your computer and use it in GitHub Desktop.
Save snorfsneflin/c4a5a99dc25385031565 to your computer and use it in GitHub Desktop.
Awk script for device discovery
#
# Class C device discovery in under 5 seconds.
# Notice that it will display information on any MAC address that nmap knows about. It's helpful to keep this updated.
# You can also add any MAC address OIDs that are newer or unknown to the file /usr/share/nmap/nmap-mac-prefixes.
#
# How to call this script:
# nmap -n -sP --excludefile $PROJECT_ROOT/output/known.skip 10.10.100-103.1-255 | awk -f $PROJECT_ROOT/mac-sort.awk
#
BEGIN { PROJECT_PATH="/path/to/scripts"; }
/Nmap scan report for/ {ip_address = $5}
/MAC Address/ {if ($4 ~ /Linksys/) linksys_ips = linksys_ips "\n" ip_address;
else if ($4 ~ /Polycom/) polycom_ips = polycom_ips "\n" ip_address;
else if ($4 ~ /Wyse/) wyse_ips = wyse_ips "\n" ip_address;
else if ($4 ~ /Cisco/) cisco_ips = cisco_ips "\n" ip_address;
else if ($4 ~ /Apple/) apple_ips = apple_ips "\n" ip_address;
else if ($4 ~ /Linux/) kvm_ips = kvm_ips "\n" ip_address;
else if ($4 ~ /Unknown/) unknown_ips = unknown_ips "\n" ip_address;
else discovered_ips = discovered_ips "\n" ip_address;
}
END { print linksys_ips > PROJECT_PATH"/output/linksys.skip";
print polycom_ips > PROJECT_PATH"/output/polycom.skip";
print wyse_ips > PROJECT_PATH"/output/wyse.skip";
print cisco_ips > PROJECT_PATH"/output/cisco.skip";
print apple_ips > PROJECT_PATH"/output/apple.info";
print kvm_ips > PROJECT_PATH"/output/kvm.info";
print unknown_ips > PROJECT_PATH"/output/unknown.info";
print discovered_ips > PROJECT_PATH"/output/discovered.info" }
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment