Locating IP Addresses of Devices on a Network

Before switching IP, it’s important to check the ARP table as it may reset. To do this, you can either utilize passive listening mode and detect incoming ARP announcements through the switch or apply brute force. It’s worth noting that brute force is significantly faster than nmap, although it’s possible that nmap wasn’t tuned properly.


Solution 1:

There are various ways to locate the device on your network. One of the easiest methods is to examine the ARP table of a different machine within the same LAN. To accomplish this on a Linux computer, you can enter the following command:

arp -a

.

One alternative method to check the DHCP leases is by accessing your DHCP server, which is typically your router. However, it may not be visible on the router’s firmware if the IP address has been fixed on the device as you mentioned.

You have two methods to detect devices on your network, which are probing and using a discovery protocol. An example of using a discovery protocol is checking your network with

nmap

by executing

nmap -sP 192.168.1.0/24

. It’s important to use the correct prefix, but it’s possible that the former is already correct because many homegrade routers use a /24 prefix as a DHCP pool. Another option is to use mDNS to detect devices, such as running

avahi-browse -a

.


Solution 2:


In Windows, the command prompt offers two options, namely

arp -a

and

arp -av

, to view all MAC<>IP mappings known to the operating system. By using these commands, you can also check if the weather station has sent any outgoing requests, such as software updates requests.

In case the device remains inactive and anticipates incoming requests, scanning the network might become necessary. However, it is advisable to disconnect the internet prior to undertaking the scan. This is because sometimes the ISP terms of service may prohibit scanning, which could lead to being locked out by the provider.

Although there is an nmap port available for Windows, it necessitates the use of pcap drivers that come with their own set of issues. It might be more prudent to begin with a simpler tool, such as Angry IP Scanner.

If the station’s IP falls outside of your PC’s subnet, it may not respond to TCP, UDP or even ARP, which means you may need to increase your IP mask to 128.0.0.0 before proceeding with scanning. Additionally, you may need to switch to another half of the address space by adding or subtracting 128 to the first number of the IP (for example, 192.168.1.5 → 64.168.1.5) before performing another scan. It’s important to note that switching IP addresses could reset ARP, so be sure to check the ARP table before proceeding.

Upon scanning either half of the address space, it is expected that the station will appear in the ARP table, regardless of its response. Subsequently, reducing the mask and changing the IP address of your PC is necessary if you intend to access the station via TCP or UDP within the same subnet.

Frequently Asked Questions