Network scanning is a crucial task for systems engineers and network administrators to identify active devices, open ports, and vulnerabilities within a network. On Windows, this can be accomplished using built-in tools and commands available in CMD (Command Prompt) and PowerShell. This article will guide you through performing network scanning using these tools.

Examples:

1. Using CMD with Ping and ARP:

   • Ping Command: The ping command is used to check the connectivity of a device within a network. It sends ICMP Echo Request messages to the target host and waits for a response.

     ping 192.168.1.1

     Replace 192.168.1.1 with the IP address of the device you want to check.

   • ARP Command: The arp command displays the ARP table on your computer, which maps IP addresses to MAC addresses.

     arp -a

     This command lists all devices that your computer has communicated with recently.

2. Using PowerShell for Network Scanning:

   • Test-Connection Cmdlet: Similar to ping, Test-Connection sends ICMP echo requests to test the connectivity of a remote device.

     Test-Connection -ComputerName 192.168.1.1 -Count 4

     This command sends four ICMP echo requests to the specified IP address.

   • Get-NetIPAddress Cmdlet: This cmdlet retrieves IP address information, which can be useful for understanding the network configuration.

     Get-NetIPAddress

     This command lists all IP addresses assigned to the local computer.

   • Port Scanning with PowerShell: Although PowerShell does not have a built-in port scanning cmdlet, you can use a script to achieve this.

     $ip = "192.168.1.1"
     $ports = 1..1024
     foreach ($port in $ports) {
      $connection = Test-NetConnection -ComputerName $ip -Port $port
      if ($connection.TcpTestSucceeded) {
          Write-Output "Port $port is open on $ip"
      }
     }

     This script checks for open ports in the range 1-1024 on the specified IP address.

3. Using Netstat for Active Connections:

   • Netstat Command: The netstat command displays active TCP connections, ports on which the computer is listening, Ethernet statistics, and more.

     netstat -an

     This command lists all active connections and listening ports.