5

You may or may not know the app "Fing". It is a bunch of network tools, available on Android and iOS at least and maybe on others devices but not sure.

The main goal of this tool is to browse for everything connected on the same WiFi network, and display some informations such as MAC addresses, IP addresses, names of devices, brand/model/manufacturer (if available). It is really powerful even in its free version and I would really like to know how it works.

One thing that is interesting me is that is it able to detect devices even when they are sleeping and I really don't know how.

What I have observed/tried this:

  • I have a sleeping iPhone on IP XX.XX.XX.200 (on subnet 255.255.255.0)
  • I ping this iPhone with my laptop (Mac OSx Yosemite), no response at all, the phone seems to sleep
  • I download and install the app "Fing" on an Android device (new installation from scratch, on a new device which has never talked with the iPhone)
  • Launch the app, and ... it finds my phone on XX.XX.XX.200, it finds its brand and model, and MAC address

(during the whole test, no response at all to my ping request on the Mac) This really intrigues me.

How can this work ?

So I have continued my investigations, and I got the idea of sniffing what is coming from this application. I have set up a TCPDump listener on the Mac, and launch the app again. So I have sniffed everything going from the app to my laptop. And here is what I obtained :

enter image description here

This is only a partial screenshot as there are more sniffed packets. It continues in the terminal but the rest looks the same.

I am wondering two things. If we randomly observe one line, for example this one :

11:47:23.914998 IP 10.11.204.34.mdns > 224.0.0.251.mdns: 0 PTR (QM)? 22.204.11.10.in-addr.arpa. (43)

I understand that the app with the IP 10.11.204.34, sends a multicasted message to 224.0.0.251. But what is this message ? And what is 22.204.11.10.in-addr.arpa. (43) ? And why are they so many packets to or from XX.204.11.10.in-addr.arpa. ?

This is a long question, and I thank you in advance for reading everything. And thank you for having reached this line.

Improve this question
6
  • can you explain what all the IP's in your trace and example actually is.
    – Pieter
    Commented Jul 10, 2015 at 7:02
  • I am in an office environment, all IPs are mainly Macs or iPhones/iPads, and some are from various wireless equipments like smart bulbs or smart audio systems.
    – phenetas
    Commented Jul 10, 2015 at 18:37
  • to understand how fring works you will have to capture the traffic to and from it. The best would be to setup a AP+SSID just for the fring device and then capture all the packets in and out of the AP for analysis.
    – Pieter
    Commented Jul 13, 2015 at 8:53
  • Hi Pieter, let assume that I can find and setup an AP just for the device running Fing. How can I see all packets going thought it ?
    – phenetas
    Commented Jul 13, 2015 at 16:48
  • -up- I have turned my Mac into an AP and sniffed for Fing packets. But it does not help me to understand what is going on unfortunately. I am still looking for help.
    – phenetas
    Commented Jul 17, 2015 at 22:01

2 Answers 2

Reset to default
3

The last part of your question:

What is 11:47:23.914998 IP 10.11.204.34.mdns > 224.0.0.251.mdns: 0 PTR (QM)? 22.204.11.10.in-addr.arpa. (43)

It is a multicast DNS lookup, the ip at the end is a reverse lookup IP->Name the ip is specified in revese order.

Thus the device 10.11.204.34 is trying to find a dns name for 10.11.204.22.

Multicast_DNS

Improve this answer
2
  • Thank you Pieter, I did not notice that the IP was in reverse order but it is true. All "reversed IPs" correspond to a real IP just in reverse order. But I don't get what is the point of doing that, because obviously these reversed IP don't exist. I am still wondering how this app can achieve to find MAC address of all devices. Can not figure it out :/
    – phenetas
    Commented Jul 13, 2015 at 5:22
  • @phenetas my guess is it sends out a multicast dns request for each ip in the local range. As the hosts answer with the host/dns name the app knows it is alive and the name.
    – Pieter
    Commented Mar 20, 2019 at 2:12
3

It's likely looking for a .local multicast DNS name for those addresses.

See rfc 6762: https://www.rfc-editor.org/rfc/rfc6762

Quote: "Any DNS query for a name ending with "254.169.in-addr.arpa." MUST be sent to the mDNS IPv4 link-local multicast address 224.0.0.251"

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.