> For the complete documentation index, see [llms.txt](https://aas-s3curity.gitbook.io/cheatsheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aas-s3curity.gitbook.io/cheatsheet/internalpentest/active-directory/reconnaissance/enumerating-machines.md).

# Enumerating Machines

## Enumerate Alive Machines

To enumerate alive machines, you can ping the RFC1918 with zmap:

```bash
sudo zmap -i <iface> -P 2 --probe-module=icmp_echoscan -B 1M --max-targets=10000000 -o targets_rfc1918.txt 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
```