IP range for servers

Is there an easy way to get an IP range for just servers joined to your AD domains/network? or another way to get an IP address for just servers? we need to do some port scanning to identify certain server roles, but I am not from a networking background. Most port scanners request a "range" on which to search, but I wasnt sure if its a standard that all servers will fall into a single "range" or whether there may be several ranges, which  may indicate we'd have to do several scans covering all ranges.
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

andreasSystem AdminCommented:
Server ips can be assigned randomly.

sometimes they are grouped at the end or beginning of subnets, but this can be very different on your network.

Or just scan the entire subnet, e.g. all IPs. shouldnt hurt much as its all internal...

How many servers are affected that needs to be scanned? If not to much just get ip for each one and scan them individually.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
pma111Author Commented:
I would guess its in excess of 300 !
andreasSystem AdminCommented:
then i'm thinking they are distributed in different ranges.

You need to ask the network guys where the servers are hosted in your organization, I hope there is a network documentation somewhere that is also in a halfway current state.

Else you really need to scan the whole ip range of your organization, fingerprint the OSes and then perform the desired scans on all detected windows servers.

Scabing through the whole network should be coordinated with the network epanrtment and management to avoid false alarms for hacking etc.
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

Will SzymkowskiSenior Solution ArchitectCommented:
I would have to agree that getting an actual list from the network team would be beneficial. Another method would be to use powershell and query on Operating System and Static IP assignment. This will probably get you most of the servers, as long as the servers are not using a DHCP address (which they shouldn't be).

If you need help with the script let me know.

pma111Author Commented:
yes please will
Will SzymkowskiSenior Solution ArchitectCommented:
Use the following powershell script below...
Import-module activedirectory
Get-ADComputer -Filter * -Properties Name, OperatingSystem, IPv4Address | 
? { $_.OperatingSystem -like "Windows Server *" } |
Select Name, OperatingSystem, IPv4Address |
Export-Csv "c:\serverlist.csv" -nti

Open in new window

The script above will get all AD Computers that have Windows Server operating systems and export it to a Csv File, with Name, OperatingSystem and IPv4Address.

It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.