We have a tomcat server running on our network somewhere we cannot find. I was hoping someone might be able to recommend a net scanner or something that might help us located it.

We recently had some pen testing done and they indicated that we have a Tomcat server running an older version of tomcat, however we have no idea what server that would be and as of yet they have not provided any way for us to identify it.

Any suggestions on how we might be able to scan for it ourselves?

2 Answers 2


Nmap can also find devices outside your current subnet, for example:



if you are connected to subnet1

and the tomcat server is on subnet2

the ip address of the tomcat server should be in range


192.168.x.1 is a gateway reserved address

192.168.x.255 is a broadcast reserved address

there is space for 254 hosts * 2 (let's assume you have 2 subnets)

2 addresses are always reserved

its uncommon to specify 1-255 in your scan range because you are looking for a host and not a nat/broadcast server means scan 256 addresses on subnet wich is also useless if you are looking for a host/server

first scan for active hosts on the subnet you are connected to using TCP stealth scan, and repeat for other subnets that are configured.

sudo nmap -sS (TCP SYN Stealth scan subnet1)

sudo nmap -sS (TCP SYN Stealth scan subnet2)

Hopefully tomcat is in your current subnet or else we have to scan another subnet as well. (192.168.x.1)


Fire up a Linux box and use nmap (command line) or zenmap (same but w/ GUI front end). You can do a discovery scan with varying levels of intensity (check common ports. vs check all ports vs. check specific port range) on an entire subnet, looking for open ports, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.