33

How do I scan a network to find out which devices are on it? (I'd be happy with a list of MAC addresses and IPs.)

For example, lets say I'm at work and want to be sure that there are no unknown devices connected to the network (especially if access is not filtered by password or MAC). DHCP logs could help, but what if I want to find devices with static IPs?

Alternatively, let us say I'm at a friends house and he wants me to setup port forwarding, but doesn't know the IP of his router. Sure, a few good guesses will usually get it, but it'd be nicer to scan.

12 Answers 12

34

For the first scenario, look at nmap. You can scan entire subnets in one command. For example: nmap -sP 192.168.0.1/24

For the second, the router IP should show up as the gateway IP for your machine. In windows, that appears in the connection status dialog.

  • nmap also includes a nice GUI tool called Zenmap for Linux, Windows, Mac OS X, BSD, etc. – Clinton Blackmore Jun 5 '09 at 16:47
  • Using -sP gives a deprecation warning, use nmap -sn 192.168.0.1/24 instead – HenryHey Nov 22 '18 at 12:29
15

You can ping to the broadcast address and see arp table. Here is a example of doing it on Linux:

ping -b 192.168.1.255
arp -n

NB: The OS of the device have to echo back to ICMP echo request. Some OS don't reply to ICMP with broadcast IP adress. In which case you can ping to every possible ip address in the network. Recently windows boxes don't reply to ICMP echo with unicast IP address by default, so this won't help.

  • How would you retrieve the arp table on Windows? – Steven M. Vascellaro Jun 21 '18 at 15:45
  • @StevenVascellaro "arp -a" – Albin Oct 7 '18 at 11:01
4

I use The Dude.

I found it here yesterday when looking for network tools. Run it on your machine and it makes a map of all equipment on your network. The best part is that it's totally free!

3

Angry IP Scanner is an awesome tool for this.

It will also allow you to export a .csv for use in IP inventory etc.

2

In response to the second question:

On Windows

  1. Windows Key + R
  2. Type in cmd
  3. At the prompt type in "ipconfig"

The output should have a line that lists the Default Gateway. There might be more than one adapter listed, but typically only one with an ip address and default gateway listed.

2

Spiceworks will provide you with detailed information about your network. Might be overkill if you're just wanting to find IP addresses and Macs, but if you need to monitor your network on an ongoing basis, it's a great tool. Otherwise use nmap.

  • Wikipedia says "Spiceworks provides a free systems management, inventory, and helpdesk software application, Spiceworks IT Desktop, designed for network administrators working in small- to medium-sized businesses." It is much more than a network scanner. While it scans all platforms, it runs on a Windows box. – Clinton Blackmore Jun 5 '09 at 16:58
2

Android app Fing just does that amazingly, I wish there would be a UNIX style command that could yield a similar result.

1

nmap, but failing that you can ping the network broadcast address and check what comes back. Coupled with checking the ARP table, this can be a fairly effective method of discovering what's on a given subnet.

For the specific example of "does not know the router IP", checking the host routing tables should reveal the default gateway and that is (often, but not always) a suitable management IP for the router.

  • 3
    Many, if not most, systems nowdays won't respond to a broadcast ping. So this is unreliable at best. – Scott Pack May 30 '09 at 14:22
1

Another good tool is look@lan. It will allow you to scan the network and will give you several different results.

  • look@lan has now become overlook fing (www.over-look.com), with a freeware Windows/Linux/Mac CLI tool called fing. It looks like it'll happily give you the data in different formats for continued processing. – Clinton Blackmore Jun 5 '09 at 16:53
0

If your network and all it's devices conform to the RFC's than you should get a reply back form all network devices when you ping the broadcast address of your network. Understandably this doesn't work very often and you have to revert to scanning each of the available IP on the full spectrum of the ports.

0

You can also use Advance IP Scanner http://www.advanced-ip-scanner.com/ or as mentioned above Angry IP scanner is awesome and open source.

0

You can use DevicesInLan in https://sourceforge.net/projects/devicesinlan/. It's opensource

protected by womble Jul 28 '17 at 9:33

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.