Python: Discovery – Fingerprint Every Device on a Subnet

sudo python3 fingerprint_subnet.py --subnet 192.168.10.0/24 --output subnet-fingerprint.csv

sudo python3 fingerprint_subnet.py --subnet 10.20.30.0/24 --oui-file /usr/share/hwdata/oui.txt --ports 22,80,443,3389,8080,9100 --timeout 1.5 --output site-b.csv

ARP-sweeping 10.20.30.0/24...
6 host(s) responded.
10.20.30.1      70:10:6f:xx:xx:xx  Hewlett Packard Enterprise   ports: 22;443
10.20.30.10     00:50:56:xx:xx:xx  VMware, Inc.                 ports: 22;80;443
10.20.30.21     00:15:5d:xx:xx:xx  Microsoft Corporation        ports: 3389
10.20.30.40     3c:d9:2b:xx:xx:xx  Hewlett Packard              ports: 80;443;9100
10.20.30.55     24:a4:3c:xx:xx:xx  Ubiquiti Inc                 ports: 22;443
10.20.30.77     b8:ca:3a:xx:xx:xx  Dell Inc.                    ports: none
Wrote 6 row(s) to site-b.csv

#!/usr/bin/env python3
"""fingerprint_subnet.py

ARP-sweeps a local subnet to find live hosts, resolves each MAC address's OUI to a
vendor name (from the IEEE oui.txt registry if supplied, otherwise a small built-in
table), probes a set of common TCP ports, and grabs a short banner from services that
offer one (SSH identification strings, HTTP Server headers, SMTP/FTP greetings).
Writes one row per discovered host to a CSV report.

Reads: command-line arguments; optionally the IEEE oui.txt file named by --oui-file.
Writes: the CSV report named by --output.
Requires: Python 3.10+, scapy, root (or Npcap + admin on Windows).
"""

import argparse
import csv
import ipaddress
import re
import socket
from concurrent.futures import ThreadPoolExecutor
from datetime import datetime, timezone

from scapy.all import ARP, Ether, srp

# Fallback vendor table, checked against the IEEE MA-L registry. Use --oui-file for real work.
OUI_VENDORS = {
    "00:50:56": "VMware, Inc.",
    "00:0C:29": "VMware, Inc.",
    "00:05:69": "VMware, Inc.",
    "00:15:5D": "Microsoft Corporation",
    "00:1A:A0": "Dell Inc.",
    "B8:CA:3A": "Dell Inc.",
    "00:23:04": "Cisco Systems, Inc",
    "00:1D:A1": "Cisco Systems, Inc",
    "3C:D9:2B": "Hewlett Packard",
    "70:10:6F": "Hewlett Packard Enterprise",
    "24:A4:3C": "Ubiquiti Inc",
    "3C:22:FB": "Apple, Inc.",
}

COMMON_PORTS = [22, 23, 25, 80, 443, 445, 3389, 8080, 8443, 9100]
HTTP_PORTS = {80, 8080}
BASE16_LINE = re.compile(r"^([0-9A-F]{6})\s+\(base 16\)\s+(.+)$")


def load_oui_file(path):
    """Parse the IEEE oui.txt format: '286FB9     (base 16)\t\tVendor Name'."""
    vendors = {}
    with open(path, encoding="utf-8", errors="replace") as handle:
        for line in handle:
            match = BASE16_LINE.match(line.strip())
            if match:
                hex_prefix, name = match.groups()
                key = ":".join(hex_prefix[i:i + 2] for i in range(0, 6, 2))
                vendors[key] = name.strip()
    return vendors


def guess_vendor(mac_address, vendors):
    prefix = mac_address.upper()[0:8]
    if int(prefix[0:2], 16) & 0x02:
        # Locally administered bit set: randomized/private MAC, no registered vendor.
        return "Locally administered (random MAC)"
    return vendors.get(prefix, "Unknown")


def arp_sweep(subnet, timeout):
    """Broadcast an ARP who-has for every address in subnet; return (ip, mac) replies."""
    packet = Ether(dst="ff:ff:ff:ff:ff:ff") / ARP(pdst=subnet)
    answered, _ = srp(packet, timeout=timeout, verbose=False)
    return sorted({(received.psrc, received.hwsrc) for _, received in answered},
                  key=lambda pair: ipaddress.ip_address(pair[0]))


def probe_port(ip_address, port, timeout):
    """Return (is_open, banner). Sends a HEAD request on HTTP ports, otherwise just listens."""
    try:
        with socket.create_connection((ip_address, port), timeout=timeout) as sock:
            sock.settimeout(timeout)
            if port in HTTP_PORTS:
                sock.sendall(f"HEAD / HTTP/1.0\r\nHost: {ip_address}\r\n\r\n".encode("ascii"))
            raw = b""
            try:
                # TCP may split the greeting; read until the first line ends (or 512 bytes).
                while b"\n" not in raw and len(raw) < 512:
                    chunk = sock.recv(512 - len(raw))
                    if not chunk:
                        break
                    raw += chunk
            except (socket.timeout, OSError):
                if not raw:
                    return True, ""
            data = raw.decode("utf-8", errors="replace")
            lines = data.splitlines()
            if port in HTTP_PORTS:
                server = [line for line in lines if line.lower().startswith("server:")]
                if server:
                    return True, server[0].strip()
            return True, lines[0].strip() if lines else ""
    except OSError:
        return False, ""


def reverse_dns(ip_address):
    try:
        return socket.gethostbyaddr(ip_address)[0]
    except OSError:
        return ""


def fingerprint(host, ports, timeout, vendors):
    ip_address, mac_address = host
    open_ports = []
    for port in ports:
        is_open, banner = probe_port(ip_address, port, timeout)
        if is_open:
            open_ports.append((port, banner))
    return {
        "ip_address": ip_address,
        "mac_address": mac_address.lower(),
        "vendor": guess_vendor(mac_address, vendors),
        "reverse_dns": reverse_dns(ip_address),
        "open_ports": ";".join(str(port) for port, _ in open_ports),
        "banners": " | ".join(f"{port}:{banner}" for port, banner in open_ports if banner),
        "scanned_at": datetime.now(timezone.utc).isoformat(timespec="seconds"),
    }


def main():
    parser = argparse.ArgumentParser(description="Fingerprint every live device on a local subnet.")
    parser.add_argument("--subnet", required=True, help="Subnet in CIDR notation, e.g. 192.168.10.0/24")
    parser.add_argument("--ports", default=",".join(str(p) for p in COMMON_PORTS),
                        help="Comma-separated TCP ports to probe")
    parser.add_argument("--timeout", type=float, default=1.0, help="ARP and per-port timeout in seconds")
    parser.add_argument("--workers", type=int, default=32, help="Hosts probed in parallel")
    parser.add_argument("--oui-file", help="Path to the IEEE oui.txt registry for vendor lookups")
    parser.add_argument("--output", required=True, help="Path to write the CSV report")
    args = parser.parse_args()

    network = ipaddress.ip_network(args.subnet, strict=False)
    if network.version != 4 or network.prefixlen < 16:
        parser.error("ARP sweeps are IPv4 only; use a /16 or smaller.")

    try:
        ports = [int(p) for p in args.ports.split(",") if p.strip()]
    except ValueError:
        parser.error("--ports must be a comma-separated list of integers.")
    if not ports or any(not 1 <= port <= 65535 for port in ports):
        parser.error("--ports values must be between 1 and 65535.")
    vendors = load_oui_file(args.oui_file) if args.oui_file else OUI_VENDORS

    print(f"ARP-sweeping {network}...")
    hosts = arp_sweep(str(network), args.timeout)
    print(f"{len(hosts)} host(s) responded.")

    with ThreadPoolExecutor(max_workers=args.workers) as pool:
        rows = list(pool.map(lambda h: fingerprint(h, ports, args.timeout, vendors), hosts))

    for row in rows:
        print(f"{row['ip_address']:15s} {row['mac_address']}  {row['vendor'][:28]:28s} "
              f"ports: {row['open_ports'] or 'none'}")

    fieldnames = ["ip_address", "mac_address", "vendor", "reverse_dns", "open_ports", "banners", "scanned_at"]
    with open(args.output, "w", newline="", encoding="utf-8") as csv_file:
        writer = csv.DictWriter(csv_file, fieldnames=fieldnames)
        writer.writeheader()
        writer.writerows(rows)
    print(f"Wrote {len(rows)} row(s) to {args.output}")


if __name__ == "__main__":
    main()