I am working on a small project that creates a map of your local network and I need to be able to determine if X.X.X.X is a router or a device connected to it.

My original strategy was to use nmap and using the result of Device type to determine if the device was a router or a computer connected to the network but when I ran this at home using my router as the target IP it returns general purpose rather than router.

Are there any accurate ways to remotely determine if X.X.X.X is a router or not?
Could I be using nmap better? I used nmap -O -v X.X.X.X.

  • 2
    But it's more interesting than the usual subnetting questions or why we use IP instead of mac addresses. For IPv6 the solution would be to ping the all router multicast address: ping6 -I eth0 ff02::2. Might even work with IPv4 (
    – user2084
    Jun 25 '14 at 11:51

This may be a bit "heavy handed" but sometimes the simplest solutions are best. Simply test to see if it works like a router. (Obviously, Jens Link's solution would be best for IPv6 but for IPv4 this wouldn't be as reliable.)

Change the default gateway on your computer to each discovered IP address and do a traceroute to www.google.com. Even if it routes to another IP on the same network, it is still processing traffic as a router. Non-router devices should just drop/reject/error the traffic.

I would recommend scripting this though, as it would be quite tedious to do manually.

  • Thanks! I will probably use this in the project. Not too sure about how fast it would run but at least it will work :)
    – jkrix
    Jun 25 '14 at 23:55
  • A router that doesn't have a route to google or a default route and isn't sending ICMP unreachable messages will also drop your traffic. Everything that passes this test is a router, but not everything that fails is not a router. Jun 26 '14 at 2:00
  • Plus you can't set your default gateway to an IP in a different subnet or VLAN, so unless all the devices on the local network are in the same subnet, this won't work. Jun 26 '14 at 2:01
  • 1
    @AveryAbbott, true on both points and quite valid. To the second comment, the OP specifically mentioned creating a map of the local network, so I didn't choose to address conditions not on the local network (although, in some cases it could still work if proxy ARP is enabled). When it comes to the first comment, barring IPv6 (which was suggested by another user first), nothing we suggest guarantees there won't be any false negatives. Only suggestions that are less likely to have them than others, and I would be happy to chat about why I think this is a better option than some of the others.
    – YLearn
    Jun 26 '14 at 4:33
  1. ping the router Multicast address (IPv4:, IPv6: FF02::2). For IPv6 capable routers this is mandatory, I'm not sure about IPv4 (at least my Fritbox at home doesn't answer to

  2. If your devices support CDP and / or LLDP (or another network layer discovery protocol) you should see routing capability in the information provided by the protocol (note this only means that the device can act as a router, not necessarily is a router).

  3. Scan your network via SNMP and parse the information you are getting. This may include CDP and LLDP information. There are several tools for this.


If you ever worked with SNMP you could try the sysObjectID OID to get Information about your device. But I´m not sure if your home Router is able to speak SNMP or not.

  • Thanks for the fast response and your suggestion! I'm preferably after something that would be really portable. Would you know any other way I could try? I think where I have to test the final application has the same router :/
    – jkrix
    Jun 25 '14 at 11:23

There's no accurate way, but you can infer it from other things. In addition to Eragon and Jens' ideas, you could sniff traffic on the local network and look for non-local addresses. The destination MAC is the MAC of the router.

  • To expand on Ron's answer, sniffing traffic on a network should reliably tell you if other hosts THINK that the device in question is a router. If another host on your network is trying to use the device in question as a router or has the device in question set as the default gateway, analysis of multiple packets will show the device in question's mac address set as the layer 2(mac) destination and varying layer 3(IP) destinations that are not part of the host's local subnet range.
    – user6254
    Jun 25 '14 at 21:50

One very, very inefficient way can be tracerouting all the host addresses on the network and traversing the resulting nodes into a tree structure, and then looking for your "device"'s position in the resulting tree. If it has leafs, you can more or less assume it does some sort of "routing".

But this is a sloppy approach. The device may have been configured to not respond traceroutes or any ICMP packets. Or it may just be idling there without nothing else connected to it(There can be several - needless to say; bad - reasons for this; there may be installation and cabling going on, someone may have unintentionally unplugged cables, rookies are fiddling with the network consistency, integrity, and security - that one is me.). Your traffic may hit a road block, like a firewall. Ports, hosts, protocols, devices may not be available at the moment. Moreover, topology changes in a sufficiently large network is not that uncommon.

Therefore, I would "reinforce" my tree building algorithm. Some SNMP, LLDP, and/or CDP integration would help a lot. I would revisit each host periodically, and "test" it over and over to try to figure out multiple paths. Sniffing out local wireless and port mapping each host can also provide information of interest.

Yet, at best, this will be an estimation. It will generate a lot of traffic, and may degrade network. This much traffic may also cause your end to be flagged as suspicious activity and you may - if it were a network I was managing, you would definitely - be "cut" from the network at the first sign of port scanning.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.