You may or may not know the app "Fing". It is a bunch of network tools, available on Android and iOS at least and maybe on others devices but not sure.
The main goal of this tool is to browse for everything connected on the same WiFi network, and display some informations such as MAC addresses, IP addresses, names of devices, brand/model/manufacturer (if available). It is really powerful even in its free version and I would really like to know how it works.
One thing that is interesting me is that is it able to detect devices even when they are sleeping and I really don't know how.
What I have observed/tried this:
- I have a sleeping iPhone on IP XX.XX.XX.200 (on subnet 255.255.255.0)
- I ping this iPhone with my laptop (Mac OSx Yosemite), no response at all, the phone seems to sleep
- I download and install the app "Fing" on an Android device (new installation from scratch, on a new device which has never talked with the iPhone)
- Launch the app, and ... it finds my phone on XX.XX.XX.200, it finds its brand and model, and MAC address
(during the whole test, no response at all to my ping request on the Mac) This really intrigues me.
How can this work ?
So I have continued my investigations, and I got the idea of sniffing what is coming from this application. I have set up a TCPDump listener on the Mac, and launch the app again. So I have sniffed everything going from the app to my laptop. And here is what I obtained :
This is only a partial screenshot as there are more sniffed packets. It continues in the terminal but the rest looks the same.
I am wondering two things. If we randomly observe one line, for example this one :
11:47:23.914998 IP 10.11.204.34.mdns > 220.127.116.11.mdns: 0 PTR (QM)? 18.104.22.168.in-addr.arpa. (43)
I understand that the app with the IP 10.11.204.34, sends a multicasted message to 22.214.171.124. But what is this message ? And what is 126.96.36.199.in-addr.arpa. (43) ? And why are they so many packets to or from XX.204.11.10.in-addr.arpa. ?
This is a long question, and I thank you in advance for reading everything. And thank you for having reached this line.