1

I am trying to detect if a netcam is connected to my network on an Android app. To do so, I have found that I need to ping every IP on the network in order to get the active devices or somehow send an ARP request. The problem is that this only gets the IP and MAC address of the device, and I would like to get some more details like the manufacturer and model, for instance. How can I do so programmatically?

There is certainly something network related that I'm not understanding because this does not appear to be a problem to some networking tools like Fing for Android, which are able to get all details on every device on a network. How do they do it?

I do not require a code answer, a theoretical answer should suffice.

5
  • I'd say, it depends (also about what "all details" means). Based on the MAC address, you can find out the vendor of the device. OS detection can be done using, e.g. fingerprinting or based on running services - maybe look at the description of nmap. Aug 6, 2015 at 10:26
  • I don't need all details, just the manufacturer would be a big start, and OS would also be very nice. How can I infer the vendor just by the MAC address? Wouldn't that require a huge table of MAC addresses and vendor names? Also, if you consider adding some more information (as an answer) I'd be happy to accept it. Aug 6, 2015 at 10:37
  • 2
    In fact, there is such a "huge" table ;-) (see my answer) Aug 6, 2015 at 11:17
  • 1
    Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 12, 2017 at 4:21
  • This was an old question that I forgot about. It was indeed answered, and I have now accepted the best answer for this question :) Aug 13, 2017 at 11:22

3 Answers 3

3

You can find the vendor of the NIC from the OUI database.

4
  • This is way too big to fit on an Android app (3,5MB just for the file). Is there any web-service or something similar that can allow me to query this database? BTW, the Fing application takes up 2,83MB for everything, so I believe they are querying it remotely somehow. Aug 6, 2015 at 11:33
  • I found a smaller version on the Wireshark website here. Aug 6, 2015 at 12:01
  • you submit it on coffer.com/mac_find and scrape the answer
    – Teun Vink
    Aug 6, 2015 at 15:26
  • It's written on the page that the last update was in July, 2013. I am unable to query for my computer's mac address. Aug 6, 2015 at 16:22
1

Instead of pinging every single device, you could ping the broadcast address, and all devices would reply. For example, if you are on a 192.168.0.0/24 network, your broadcast address would be 192.168.0.255. Then all devices would send out an ARP reply. From here you could run a port scan on the specific IP address that the MAC in question is tied to. If you don't know the MAC address, you're going to have to do a scan on every device that replies.

9
  • Is this supposed to work on a command line? I can't get it to work: I ping the broadcast address and get nothing back out of the ordinary.. Aug 6, 2015 at 16:15
  • 1
    It should work just fine from any device that can ping. And has an arp table. Once you ping the broadcast, check the arp table for new entries. Aug 6, 2015 at 16:18
  • I forgot to check the arp table. It does indeed work. However, when the device I'm looking for gets disconnected, the ARP table does not reflect that change: the device continues listed. Is this a normal behaviour and if so, why? Aug 6, 2015 at 16:29
  • 1
    To see the change, you would have to flush your ARP cache and ping the broadcast address again to update it. This is normal behavior, ARP is essentially agnostic of other device's link-state and a device will stay in the arp cache until it is cleared again, or another device sends an ARP reply using the same IP as the previous device. Aug 6, 2015 at 20:29
  • Why is the port scan going to be necessary? If StephenKing's info is correct, can't I just get the MAC address with the ARP reply and use it to check the manufacturer in the OUI database? Aug 6, 2015 at 20:54
1

Fing, Angry IP, netstat and arp -a are good starters...and depending on whether you have access to the infrastructure you can check the dhcp scope and issuance...along with CDP or LLDP on the networking equipment.

Fing though its good!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.