In our network, there are 2 subnets (255.255.255.0 & 255.255.252.0) and 2 IP gateways, which filters which machine will get connected to Internet thru proxy(filtered) or not. So an example of unfiltered machine, will have two IPs (bind) but using only the unfiltered gateway to the internet.

Question is, how do I obtain the gateway of these unfiltered machine (thru scanning, etc.)?