Logical Link Mapping

Cheat Sheet

Active Logical Link Mapping

Map Layer-3

Nmap

Map Layer-3 Paths using subnet

nmap -sn -Pn --traceroute 192.168.1.0/24

Ping Scan

Nmap

TCP SYN & ACK & UDP & ICMP Ping

nmap -sn -PS -PA -PU -PE -PP -PM $TARGET

Ping

Ping for live host

ping $TARGET

Discovery

Nmap

Discover DHCP & IGMP & OSPF & PPPoE & RIPv2

sudo nmap \
    --script=broadcast-dhcp-discover,broadcast-dhcp6-discover,broadcast-igmp-discovery,broadcast-ospf2-discover,broadcast-pppoe-discover,broadcast-rip-discover

Network discovery and routing information gathering through EIGRP

nmap --script=broadcast-eigrp-discovery  $TARGET

Traceroute

traceroute

Basic Traceroute

traceroute 192.168.10.10

ICMP-Based (Linux default)

traceroute -I $TARGET

TCP Traceroute (Firewall-aware)

traceroute -T -p 443 $TARGET

mtr

Using MTR for Real-Time Path Discovery

mtr $TARGET

Passive Logical Link Mapping

Wireshark

1. Open Wireshark

2. Capture traffic on a specific interface

3. Filter layer 3 protocols: dhcp or icmp or igmp or ospf or bgp or eigrp or rip or glbp or hsrp or vrrp

tshark

Passive layer-3 packet capture

sudo tshark -i eth0 \
    -Y "dhcp or icmp or igmp or ospf or bgp or eigrp or rip or glbp or hsrp or vrrp" \
    > capture-layer3.txt