I'm doing research for a solution to a problem.
My boss has asked me to see if there is a way to look beyond our subnet gateway to find gateways to other subnets owned by our company all from a host machine on our LAN. Basically, the only parameters that are known are the host machine IP address, the subnet mask, and the default gateway IP address. The external gateway machine IP addresses cannot be known in advance.
I've done some research into ARP spoofing and similar techniques for redirecting gateway traffic on a LAN but the problem is that I need to see the data packets from the incoming IP addresses on the internet side of our LAN gateway before I can start determining the IP addresses any external gateway machines. From what I've read online I don't think you can ARP spoof your way outside of your subnet gateway. My boss suggested that there may be a way to work with Routing Protocols to be able to do this.
So far I'm at a loss on this problem any advice would be helpful.