Using Masscan to Perform Asset Discovery in Meraki and Cisco Networks

by

Asset discovery is a crucial step in managing and securing network environments. For organizations using Meraki and Cisco networks, leveraging tools like Masscan can significantly streamline this process. Masscan is a fast network scanner capable of scanning large IP ranges quickly, making it ideal for identifying active devices in complex network infrastructures.

Understanding Masscan

Masscan is an open-source network scanner designed for high-speed scanning. Unlike traditional tools, it can scan the entire Internet in a matter of minutes. Its speed is achieved through asynchronous transmission, allowing it to send many packets simultaneously. This makes it highly effective for asset discovery across large networks like those managed by Meraki and Cisco.

Preparing for Asset Discovery

Before using Masscan, ensure you have proper authorization to scan the network. Unauthorized scanning can violate policies and laws. Additionally, identify the IP ranges associated with your Meraki and Cisco devices. This targeted approach minimizes network disruption and focuses your scan on relevant segments.

Gathering Network Information

  • Identify the IP address ranges of your Meraki and Cisco networks.
  • Ensure your scanning machine has network connectivity to these ranges.
  • Review network policies regarding scanning activities.

Using Masscan for Asset Discovery

To perform an asset discovery scan, use Masscan with the appropriate parameters. A typical command might look like this:

masscan -p1-65535 192.168.0.0/16 –rate=1000 -oG scan_results.txt

In this example:

  • -p1-65535 scans all TCP ports.
  • 192.168.0.0/16 specifies the target IP range.
  • –rate=1000 limits the packets sent per second to avoid network overload.
  • -oG saves the output in a grepable format for easy parsing.

Refining Your Scan

You can tailor your scan to specific ports or protocols relevant to Meraki and Cisco devices. For example, to scan only common management ports:

masscan -p22,80,443,22 192.168.0.0/16 –rate=1000 -oG scan_results.txt

Analyzing Scan Results

After completing the scan, review the output file to identify active devices. Look for open ports and device responses that indicate Meraki or Cisco equipment. This information helps in inventory management and security assessments.

Tools like grep or custom scripts can parse the results for specific device signatures or IP addresses, streamlining the asset discovery process further.

Best Practices and Considerations

When using Masscan:

  • Always obtain permission before scanning.
  • Limit scan rates to avoid network disruption.
  • Combine Masscan with other tools like Nmap for detailed device fingerprinting.
  • Maintain an updated inventory of your network ranges.

Masscan is a powerful tool for asset discovery in Meraki and Cisco networks. Properly used, it enhances visibility and security posture, helping administrators identify active devices and potential vulnerabilities efficiently.