Suppose one has configured a bog standard Ethernet connection - there is an IPv4 address, a subnet specification, a default route, even nameservers in resolv.conf, static routes everywhere - is it possible for client software to find other hosts on the same network that route to, say, the Internet?
I guess one could just send packets to, for example, 18.104.22.168 using an Ethernet frame directed at a maybe-router and see whether something else comes back. I don't see why it wouldn't work, but am trying to find out why it's not done in practice. Does modern Windows do this? Wouldn't Skype try something like this?
In security terms, I'm asking whether this possible covert channel can be autodiscovered by "slightly-misbehaved" software like Skype.