netmask

This is also a very simple tool. It sends an ICMP Netmask (ICMP type 17) request to the target, and in the answer (ICMP type 18) we should find the subnet mask of the target. This way we can get more information about the IP addressing structure at the target. Usually most of the firewalls are filtering these messages, but even if they don't the hosts replies many times with /32.

We can print the result in many different ways, most of the options are related to the representation. Here are a couple of examples:

netmask 192.168.1.1 -b - bit view

netmask 192.168.1.1 -c - CIDR view

netmask 192.168.1.1 -s - standard view

netmask 192.168.1.1 -r - range view

root@bt:~# netmask 192.168.1.1 -b
11000000 10101000 00000001 00000001 / 11111111 11111111 11111111 11111111

root@bt:~#netmask 192.168.1.1 -c
    192.168.1.1/32

root@bt:~# netmask 192.168.1.1 -s
    192.168.1.1/255.255.255.255

root@bt:~# netmask 192.168.1.1 -r
    192.168.1.1-192.168.1.1     (1)

Látszik, hogy a routerem is /32-t ad vissza annak ellenére hogy /24 a subnet mask.