ifconfig -a | perl -lne 'print $_ for /\b(?!255)(?:\d{1,3}\.){3}(?!255)\d{1,3}\b/g' | xargs nmap -A -p0-
ifconfig -a
prints all network interfaces.
The regular expression \b(?!255)(?:\d{1,3}\.){3}(?!255)\d{1,3}\b'
searches for 4 octets with up to three digits each, ignoring any leading or trailing 255. For personal, and likely most local networks, this will exclude broadcast and netmask addresses without affecting host IPs.
The -lne
flags of perl
effectively execute the specified Perl command for each line of input. With the /g
flag at the end, the pattern /.../g
looks for all matches in the input, and returns the matches as a list. print $_ for /.../g
means to print each match.
At this point, stdout
holds any IP assigned to an interface. We pipe this to xargs
, to execute for each line nmap -A -p0-
, which performs OS detection, version detection, script, and traceroute scan on all 65536 ports of each IP address.
The regex epression will find both valid and non-valid IP addresses, e.g. 999.999.999.999, however invalid IPs are not an expected result of ifconfig -a
. It is possible to correct this with a much longer regex expression, but not necessary in this case.