Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
There are lots of tools like nmap and I am using one for android that discovers every (?) host on the network that I am connected to. I do not understand what kind of packets are send by the program to find out these hosts.
Do they send broadcast packets? Do they calculate all the possible IPs in their network using the subnet mask and then send ICMP packets to each of those addresses and then expect answers?
Each "discovery" tool, like nmap, has its own recipe in matters of discovery, and you can make some very trivial scans as some more advanced. Each tool is not equivalent in terms of capability. In order to keep my answer simple, I will not describe all the internal tricks that a complex and exhaustive tool like nmap can do. (But you can find a complete description of how nmap works just on discovery here).
In terms of host discovery on the same subnet, the simplest and most basic way to do it, is to send pings to each IP address in the subnet, and expect a reply.
To give an answer to your question, the most widely used packets sent to do this are:
The problem is that you will not discover hosts which do not choose to reply, like the ones running their own firewall.
Sending a broadcast packet is not a reliable solution either, because some hosts do not reply to broadcast, often for the same reason (their own firewall).
A way to make this technique more efficient is to check immediately the ARP table of the scanning host, and to check if there is any MAC address associated with the IP we sent the packet on just before, because ARP traffic is not blocked by an IP firewall.
If you want to go further, ARP discover is not reliable either on some networks (like some wireless spots) where security restricts traffic only between the host and the gateway. So you will not be able to "talk" to other hosts directly connected to the network, excepting the gateway.
Just one last thing: you are talking about "the network you are connected to". If the network contains several subnets, you lose the ARP visibility as soon as you are trying to scan another subnet than the one you are in (the ARP scope is never wider than the subnet).
