Pattern Screamer: Subnet Discovery in Networks with Unknown Addressing Intro Penetration testers connecting to networks with unknown addressing, or network administrators who lack network inventory information, often find themselves in the same situation: they have no idea where the routing devices are located or which subnets lie behind them. Port scanning seems like the obvious solution, but because of large address spaces such as 10.0.0.0/8 or 172.16.0.0/12 , this approach is very costly: Exhaustively scanning all addresses and ports places a significant load on the production equipment, which may be sensitive to such stress A significant part of the address space may not be used, but this does not shorten the already long scan When tracing a route, devices reveal their interface addresses: a router whose TTL expires sends ICMP Time Exceeded, while the destination host replies to the probe itself with ICMP Destination Unreachable, SYN-ACK, or TCP RST, depending on its type. The “Screamer” tool covered in this article uses this mechanism to perform reconnaissance based on TTL tracing and build a network graph without excessive scanning. Disclaimer This article is for educational purposes and describes techniques for authorized security testing only. All demonstrations were performed in an isolated lab on networks under my control. The author assumes no liability for any misuse of the information presented here. Traceroute Basics Traceroute typically uses ICMP or UDP probes to build a chain of router hops leading to the destination host. The sender sends packets sequentially, incrementing their TTL by 1. When the packet’s lifetime expires, according to RFC 792 , Page 7: each router is required to respond with an ICMP Time Exceeded packet, exposing its IP address. When the packet reaches the destination host, the host responds with another packet (for example, an Echo Reply or a Port Unreachable, depending on the probe type and the availability of the host or port) Tracing is based on the TTL (Time to Live) field in the IPv4 packet header. TTL specifies the maximum number of hops a packet can pass through before reaching its destination and functions as a counter: each time the packet passes through a router, the value is decremented by 1. When the TTL reaches 0, the router drops the packet and sends an ICMP Time Exceeded packet: Traceroute Limitations The default tools like traceroute and tracert are designed to diagnose a single route to a specified host. This is not sufficient for network infrastructure discovery: the trace only returns the path to a single specific address. To determine which subnets are present in the infrastructure, you must either know the complete list of destination addresses in advance or perform multiple traceroutes. The second option generates excessive network traffic and is very time-consuming. Subnet Tracing The main challenge at the start of network infrastructure reconnaissance is that an attacker or administrator may not have a rough idea of the network address space in use. For example, a range such as 10.0.0.0/8 contains over 16 million addresses, and attempting to sequentially trace all of them reduces TTL tracing to the same issues: it’s slow and noisy. Heuristic Sampling As a solution, I propose dividing the original address space into the smallest possible blocks, within which the gateway is highly likely to take one of the predictable positions. In enterprise networks, the typical segmentation unit is a /24 prefix; within this prefix, the gateway typically has a fourth octet of .1 or .254 . This is not a mandatory rule, but it is common enough to be used as a heuristic. This approach has two steps: Slicing: The original prefix is split into a set of /24 subnets Host positioning: From each /24 network, the addresses most likely to serve as gateways are selected (in the “Screamer” tool, these are .1 and .254 by default ). The --positions flag allows you to manually specify any number of positions def expand_targets (cidr, host_positions): network = ipaddress.ip_network(cidr, strict = False ) if network.prefixlen <= 24 : subnets = network.subnets( new_prefix = 24 ) else : subnets = [network] targets = [] for subnet in subnets: for position in host_positions: try : targets.append( str (subnet[position])) except IndexError : pass return targets Prefix Subnets First /24 Last /24 10.0.0.0/8 65,536 10.0.0.0/24 10.255.255.0/24 172.16.0.0/12 4,096 172.16.0.0/24 172.31.255.0/24 192.168.0.0/16 256 192.168.0.0/24 192.168.255.0/24 For example, with 172.16.0.0/12 , the address space is divided into 4,096 /24 subnets, and then only two addresses are selected from each /24 subnet: .1 and .254 . This covers all /24 subnets in the original space, and the most likely gateway address is checked in each one (for example, a /16 gives 256 subnets, i.e. 65,536 host addresses, reduced to 512 probe targets) In this way, the approach using selective sampling and TTL probing makes it possible t...