trying to do threaded ping scan of subnet - no echo reply received
Posted on 2007-10-10
I am trying to do a fast ping scan of a private subnet using raw sockets and threads. Reader thread is waiting on FD_READ event (raw socket) to collect echo replies. Main thread issues a burst of echo requests (raw socket not icmp.dll) to trigger the responses. This results in a large number of ARP requests (only 3 devices currently on subnet), which is to be expected. I have devices at 192.168.1.1, 192.168.1.71, and 192.168.1.101 (101 is my host machine). I see the ARPs fly, get an ARP response from 192.168.1.1, more ARPs, echo request goes out, echo response comes back (from .1), echo request goes to .71 but never get an echo response again. Why don't I get the response from .71? If I change 192.168.1.1 to .4 then I get no echo response at all (program starts sending with .1, so the ARPs start). It seems as if the ARPs are causing the echo requests to be ignored. Looking for why and how to make this work. Need to scan multiple subnets to ensure local machines are up and running. Waiting for seconds between pings is not acceptable. My only alternative seems to be an "ARP scan". Ideas? Don't respond with "it can't be done". If nothing else it can be done via ARP, but I at least want to know why it fails with ICMP. Current code is written in C++ and running on winXP. I am monitoring traffic using ethereal (on another machine - all connected to a 10-base hub).