NAME

       ass - autonomous system scanner

SYNOPSIS

       ass [-v[v[v]]]  -i <interface> [-p] [-c] [-A] [-M] [-P IER12] -a <autonomous system start> -b <autonomous
       system stop> [-S <spoofed source IP>] [-D <destination ip>] [-T <packets per delay>]

DESCRIPTION

       This  manual  page  documents  briefly  the  ass  command.   This  manual page was written for the Debian
       distribution because the original program does not have a manual page.

       ASS, the autonomous system scanner, is designed to find the AS of the router.  It supports the  following
       protocols: IRDP, IGRP, EIGRP, RIPv1, RIPv2, CDP, HSRP and OSPF.

       In  passive  mode  (./ass  -i  eth0),  it  just  listens  to routing protocol packets (like broadcast and
       multicast hellos).

       In active mode (./ass -i eth0 -A), it tries to discover routers by asking for information. This  is  done
       to  the appropriate address for each protocol (either broadcast or multicast addresses). If you specify a
       destination address, this will be used but may be not as effective as the defaults.

       EIGRP scanning is done differently: While scanning, ASS listens for HELLO packets and then scans  the  AS
       directly  on  the  router  who  advertised  himself.  You  can force EIGRP scanning into the same AS-Scan
       behavior as IGRP uses by giving a destination or into multicast scanning by the option -M.

       For Active mode, you can select the protocols you want to scan for. If you don't  select  them,  all  are
       scanned.  You  select protcols by giving the option -P and any combination of the following chars: IER12,
       where:

       I = IGRP

       E = EIGRP

       R = IRDP

       1 = RIPv1

       2 = RIPv2

       ASS output might look a little strange, but has it's meanings:

       Routers are identified by the sender's IP address of the packet. This may lead to several routers showing
       up as more then one since they used different sender interfaces. In  the  brackets,  the  protocols  this
       router runs are shown.

       Routing  protocols  are  shown  as  one or more indented lines. First, there is the routing protocol name
       (like EIGRP), followed by the autonomous system number in brackets. Aligned to the right  is  the  target
       network if applicable.

       IGRP  routing  info shows the target network and in brackets the following values: Delay, Bandwidth, MTU,
       Reliability, Load and Hopcount.

       The IRDP info is limmited to the announced gateway (router) and it's preference

       RIPv1 info just gives you the classified target network (remember  RIPv1  network  boundaries)  and  it's
       metric

       RIPv2  info  contains after the target network the following infos: Netmask, next hop, arbitrary tag, and
       the metric. An additional line may appear on the routers section that gives  you  the  authentication  if
       enabled in the protocol. For text auth, the password is there.

       The  basic  EIGRP  just gives you the autonomous system number, the IOS and EIGRP version as found in the
       HELLO packet

       The EIGRP routes section depends on the type of  route.  All  of  them  include  the  fields  destination
       network,  destination  mask  and  in  the  last  line (in brackets) the values for Delay, Bandwidth, MTU,
       Reliability, Load and Hopcount. External routes also include  the  originating  router,  the  originating
       autonomous system, the external metric and the source of this route.

       HSRP  info  is  not  routing,  therefore  the third field is the virtual IP address of the standby group,
       followed by the state, the auth string, Hello, Hold and priority values.

       OSPF info includes the destination network as well as the Area in  IP  format,  the  authentication  used
       (and,  if  applicable  the  auth  string), netmask, designated and backup router and the values for Dead,
       Priority and Hello.

OPTIONS

       A summary of options is included below.

       -h     Show summary of options.

       -i <interface>
              interface

       -v     verbose mode

       -A     Active mode scanning

       -P <protocols>
              Select protocols to scan

       -M     EIGRP systems are scanned using the multicast address and not  by  HELLO  enumeration  and  direct
              query

       -a <autonomous system>
              autonomous system to start from

       -b <autonomous system>
              autonomous system to stop with

       -S <spoofed source IP>
              maybe you need this

       -D <destination IP>
              If you don't specify this, the appropriate address per protocol is used

       -p     don't run in promiscuous mode (bad idea)

       -c     terminate after scanning. This is not recommended since answers may arrive later and you could see
              some traffic that did not show up during your scans

       -T <packets per delay>
              how  many  packets  should  we  wait  some milliseconds (-T 1 is the slowest scan -T 100 begins to
              become unreliable)

AUTHOR

       This manual page was written by Vince Mulhollon <vlm@debian.org>, for the Debian  GNU/Linux  system  (but
       may be used by others).

                                                December 16, 2002                                         ASS(1)