writing a network discovery tool in Objective-C

Question

I want to embark on a project for a CS class.

Can anyone provide insight on how to write a tool that will map out a network and state device info, IP info, open ports, etc.

I will be using OS X.

Answer 1

There's a few things you can use to discover the nodes on a network.

• SNMP will help detect a few different network devices. Broadcasting an SNMP get request for sysName.0 will give you results from anything that responds to SNMP (even if they do not have a value for the OID). Some may be printers, some may be servers, some may be NAS etc. sysDescr.0 can also be used although for many network devices (in my experience) it returns the same value as sysName.0. Mac OS X comes with the NetSNMP libraries. Once you have received responses from SNMP agents, you can then send extra SNMP requests to further determine details about the device. There are human readable files that explain these in detail in /usr/share/snmp/mibs.

• You can use a broadcast ping (your application will require root privileges to give you raw access to the Internet Protocol for constructing a broadcast ping packet, or a ping packet in general). Just broadcast a few packets and wait for replies. The source code to BSD's ping utility used in Mac OS X can be found at Apple's website. The ping executable is usually installed with owner root and with the setuid bit, meaning that the ping executable is run as root even when invoked by a non-root user (this is why non-root users can use ping). You'll notice though that in ping's source code it only creates the socket as root and then immediately drops its root privileges.

• Zeroconf/Bonjour will also help. Have a look at Core Foundation's CFNetServices or Foundation's NSNetServices. Mac systems can be configured to publish themselves very easily. There are also Windows and Linux implementations but of course, these need to actually be running on the network devices before you can detect them with your program.

• In order to determine what ports are open, you can simply run a loop over the desired port range and attempt to make a connection. Keep in mind though that many servers consider this an attack and will drop packets and perhaps even permanently blacklist your IP. Once you have made a successful TCP connection, you can look up the port number in the /etc/services file to determine the name of the service. This can be done using the POSIX function getnameinfo.