I'm trying to understand how to determine if a device plugged to my PC with Ethernet cable has a static IP.

What I'm trying to do is to sniff DHCP packets that it sends and by looking at DHCPDISCOVER packet, precisely at Requested Ip Address (50) field, recognize what address device sets into it.

But recently I realized that if a device has information about previously leased IP address, it would also provide that address in DHCPDISCOVER packet and now I am confused.

So how do I exactly tell if a device has static IP address bound to it?

  • To determine if a device is statically configured, you get into the device and look at the configuration. Unfortunately, questions about host/server configurations are off-topic here. You could try to ask this question on Server Fault for a business network. – Ron Maupin Apr 20 '19 at 18:38
  • @RonMaupin unfortunately I am not able to get into a device to see if it is statically configured. Thanks for the guidance, I'll try to ask it there. – Dlbas Apr 20 '19 at 18:41

Devices with a static address do not use DHCP at all, so one way to tell is that you won’t see any DHCP packets.

Devices that do use DHCP and have an unexpired lease will attempt to verify that the address is still valid. How they do so is dependent on the OS.

| improve this answer | |
  • I apologize for my incompetence, but is there a way to get a non-DHCP device IP address by inspecting its packets? – Dlbas Apr 20 '19 at 19:12
  • Update: found out that technically I can find static IP of the device by listening to gratuitous ARP requests it broadcasts. Please, correct me if I'm wrong. – Dlbas Apr 20 '19 at 20:41
  • If you can otherwise identify the device packets (e.g., you know the MAC address) every packet has the IP address. – Ron Trunk Apr 20 '19 at 20:52
  • Yes, I guess that would be a solution, given that I will connect the device via Ethernet cable. Thanks, Ron! – Dlbas Apr 20 '19 at 21:06

Not the answer you're looking for? Browse other questions tagged or ask your own question.