discovering computers on home network?

mma8x · 11-04-2005, 02:15 PM

any advice on how see who's connected to my network at any time? using a linksys wireless b router; i can use the web-based interface, but that isn't always accurate. which terminal based or graphic front ends can i use to find this info?

grim1234 · 11-04-2005, 02:41 PM

nmap is useful.

you can do :

$nmap -sP 192.168.0.*

this will ping all hosts on the subnet 192.168.1. and give you a list of who's online.

However, I think that windows xp sp2 machines, with the windows firewall switched on won't respond (can anyone confirm?).

you could conclusively test for machines by doing :

$nmap -sS -p 1-1500 192.168.1.*

but this scan would take a while to complete.

nmap is selected for install by default on slackware, not sure about other distros.

Hope this helps,

G.

crispyleif · 11-05-2005, 03:12 PM

Window native firewall and others won't respond to simple ping, I've tested with Kerio and Sygate in win. Also in linux, many firewalls wont respond, like firehol.

guzzi · 11-05-2005, 08:28 PM

You might enjoy tcpdump.

running tcpdump will show all communication going on on the network.

Windows units tend to chatter a fair amount.

grim1234 · 11-07-2005, 08:13 AM

If you want to look at traffic on the network you will probably find ethereal much better than tcpdump (imo).

G.

nx5000 · 11-07-2005, 09:12 AM

I like Ntop , it gives some nice graphs.

Nmap is active
Ntop/ethereal/.. are passive, they don't send anything

darrellc · 11-07-2005, 05:40 PM

Smb4k gives a nice tree after you set it up for your network, complete with host names and ip addresses.

primo · 11-07-2005, 09:23 PM

Check the ARP's cache. See arp(8)

Anything related with the broadcast address (that you may see with both ifconfig and netstat) may do as well, but many times ICMP is blocked. Any sub IP protocol is easy to block with these firewalls, so ARP may be better, if your network permits it.