|
Written by Thireus
|
|
Thursday, 21 April 2011 18:46 |
|
Assuming the router you're connected to does not filter any IPv4 broadcasts, you can easily use ping to perform a quick scan to get a list of all responding IP around you.
For example, if your network is 192.168.1.0:
ping 192.168.1.255
Will give you something like:
Thireus:~ thireus$ ping 192.168.1.255 PING 192.168.1.255 (192.168.1.255): 56 data bytes 64 bytes from 192.168.1.102: icmp_seq=0 ttl=64 time=0.087 ms 64 bytes from 192.168.1.1: icmp_seq=0 ttl=64 time=0.553 ms (DUP!) 64 bytes from 192.168.1.152: icmp_seq=0 ttl=64 time=124.870 ms (DUP!) 64 bytes from 192.168.1.102: icmp_seq=1 ttl=64 time=0.065 ms 64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.454 ms (DUP!) 64 bytes from 192.168.1.152: icmp_seq=1 ttl=64 time=39.073 ms (DUP!)
Then arp will list you all MAC adresses associated to the IP that replied:
Thireus:~ thireus$ arp -a ? (192.168.1.1) at 0:14:8d:41:87:1a on en0 ifscope [ethernet] ? (192.168.1.102) at e3:7a:2b:79:55:11 on en0 ifscope [ethernet] ? (192.168.1.152) at e1:15:d6:55:34:12 on en0 ifscope [ethernet] ? (192.168.1.255) at ff:ff:ff:ff:ff:ff on en0 ifscope [ethernet]
I found this trick when the DHCP server of my router was not replying. I performed a broadcast ping as shown bellow. The router replied with its own IP.
|