We have a tomcat server running on our network somewhere we cannot find. I was hoping someone might be able to recommend a net scanner or something that might help us located it.

We recently had some pen testing done and they indicated that we have a Tomcat server running an older version of tomcat, however we have no idea what server that would be and as of yet they have not provided any way for us to identify it.

Any suggestions on how we might be able to scan for it ourselves?


Nmap can also find devices outside your current subnet, if your building has multiple subnets (ex. and and the tomcat server is on the other one you're not conneted to, we can eventually look further...

Open a terminal, check your current gateway and subnet mask, and afterwards run a TCP stealth scan on the gateway.

ip route

sudo nmap -sS

-sS means TCP SYN (Stealth) scan type means your gateway

/24 means scan 256 addresses on gateway (or 254 hosts - excluding gateway and broadcast reserved address)

Hopefully tomcat is in your current subnet or else we have to scan the other subnets as well. (192.168.x.1)

| improve this answer | |

Fire up a Linux box and use nmap (command line) or zenmap (same but w/ GUI front end). You can do a discovery scan with varying levels of intensity (check common ports. vs check all ports vs. check specific port range) on an entire subnet, looking for open ports, etc.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.