0

I am trying to detect if a netcam is connected to my network on an Android app. To do so, I have found that I need to ping every IP on the network in order to get the active devices or somehow send an ARP request. The problem is that this only gets the IP and MAC address of the device, and I would like to get some more details like the manufacturer and model, for instance. How can I do so programmatically?

There is certainly something network related that I'm not understanding because this does not appear to be a problem to some networking tools like Fing for Android, which are able to get all details on every device on a network. How do they do it?

I do not require a code answer, a theoretical answer should suffice.

  • I'd say, it depends (also about what "all details" means). Based on the MAC address, you can find out the vendor of the device. OS detection can be done using, e.g. fingerprinting or based on running services - maybe look at the description of nmap. – StephenKing Aug 6 '15 at 10:26
  • I don't need all details, just the manufacturer would be a big start, and OS would also be very nice. How can I infer the vendor just by the MAC address? Wouldn't that require a huge table of MAC addresses and vendor names? Also, if you consider adding some more information (as an answer) I'd be happy to accept it. – goncalotomas Aug 6 '15 at 10:37
  • 2
    In fact, there is such a "huge" table ;-) (see my answer) – StephenKing Aug 6 '15 at 11:17
  • 1
    Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 12 '17 at 4:21
  • This was an old question that I forgot about. It was indeed answered, and I have now accepted the best answer for this question :) – goncalotomas Aug 13 '17 at 11:22
3

You can find the vendor of the NIC from the OUI database.

| improve this answer | |
  • This is way too big to fit on an Android app (3,5MB just for the file). Is there any web-service or something similar that can allow me to query this database? BTW, the Fing application takes up 2,83MB for everything, so I believe they are querying it remotely somehow. – goncalotomas Aug 6 '15 at 11:33
  • I found a smaller version on the Wireshark website here. – goncalotomas Aug 6 '15 at 12:01
  • you submit it on coffer.com/mac_find and scrape the answer – Teun Vink Aug 6 '15 at 15:26
  • It's written on the page that the last update was in July, 2013. I am unable to query for my computer's mac address. – goncalotomas Aug 6 '15 at 16:22
1

Instead of pinging every single device, you could ping the broadcast address, and all devices would reply. For example, if you are on a 192.168.0.0/24 network, your broadcast address would be 192.168.0.255. Then all devices would send out an ARP reply. From here you could run a port scan on the specific IP address that the MAC in question is tied to. If you don't know the MAC address, you're going to have to do a scan on every device that replies.

| improve this answer | |
  • Is this supposed to work on a command line? I can't get it to work: I ping the broadcast address and get nothing back out of the ordinary.. – goncalotomas Aug 6 '15 at 16:15
  • 1
    It should work just fine from any device that can ping. And has an arp table. Once you ping the broadcast, check the arp table for new entries. – Chris Cummings Aug 6 '15 at 16:18
  • I forgot to check the arp table. It does indeed work. However, when the device I'm looking for gets disconnected, the ARP table does not reflect that change: the device continues listed. Is this a normal behaviour and if so, why? – goncalotomas Aug 6 '15 at 16:29
  • 1
    To see the change, you would have to flush your ARP cache and ping the broadcast address again to update it. This is normal behavior, ARP is essentially agnostic of other device's link-state and a device will stay in the arp cache until it is cleared again, or another device sends an ARP reply using the same IP as the previous device. – Chris Cummings Aug 6 '15 at 20:29
  • Why is the port scan going to be necessary? If StephenKing's info is correct, can't I just get the MAC address with the ARP reply and use it to check the manufacturer in the OUI database? – goncalotomas Aug 6 '15 at 20:54
1

Fing, Angry IP, netstat and arp -a are good starters...and depending on whether you have access to the infrastructure you can check the dhcp scope and issuance...along with CDP or LLDP on the networking equipment.

Fing though its good!

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.