I have an Internet of things (IoT) device with known MAC address, which is connected to a network. First, lets assume that this network is large (subnet 255.255.0.0). Is there any "smart" way to discover the ip of this device from a PC in the network (by smart, I mean not brute force and scan all ip's until we find the MAC) How do usually people deal in this kind of situation? Moreover, lets assume that we can use whatever ports we want and we are free to run any scripts on both devices.
2 Answers
Check your router - if said device accesses the Internet (or anything else beyond the router) the router has the device's IP and MAC addresses in its ARP cache.
If you've got a managed switch in between you could use port mirroring and packet capturing to look for any packet with the known MAC address in the frame. Many IoT devices pollute the network with broadcasts anyway, so you might just need a simple capture.
If the switch supports sFlow or NetFlow you could use that to capture statistics about the port, including source IP addresses.
Of course, on the device itself you could simply look up the address.
arping or watch the network for ARPs for that MAC. The later only works if something is actively talking to it. If the application(s) on the device have a layer-2 / layer-3 broadcast discovery mechanism, that would be the ideal way to find it. If you have access to the router, look in it's arp cache.
/64IPv6 networks, and most IoT networks use IPv6. Trying to scan a network with18,446,744,073,709,551,615possible addresses, even at1,000,000addresses per second, would take over584,542years!