How to list all devices on the Windows or Linux home network

[Anda Lucite]

How does my Android phone figure out what's on my network
without logging into the home router?

I can see 8 devices on the network when I log into the admin account
of the router using a web browser on a laptop.

However, I can see all those devices from my Android phone WITHOUT
logging into the router, simply by using "Fing" Android freeware:
https://i.imgur.com/Szjbr5f.gif

My question?

How does the phone see both wired & wireless devices (such as a
wired printer & a wired Ooma) without logging into the router?

More importantly, how can I get Windows & Linux to see the
same 8 or 9 devices on my network that the phone sees *without*
logging into the router's admin account?

[J.O. Aho]

On 02/18/2016 06:42 AM, Anda Lucite wrote:

>
> How does the phone see both wired & wireless devices (such as a
> wired printer & a wired Ooma) without logging into the router?

It's asking the network and the others replies.

> More importantly, how can I get Windows & Linux to see the
> same 8 or 9 devices on my network that the phone sees *without*
> logging into the router's admin account?

KDE's dolphin should be able to see all on the network.
Microsoft I don't know, it usually fussy about the domain name.

--

//Aho

[winst...@gmail.com]

Could it be some type of ARP cacheing with comparison to validate and
provide the ip and MAC addresses ???
--
...winston
msft mvp windows experience

[wimpunk]

I would guess it uses something like avahi or bonjour...

[Whiskers]

arp-scan - runs on Linux, needs root.

--
-- ^^^^^^^^^^
-- Whiskers
-- ~~~~~~~~~~

[Ken Springer]

Whiskers has the secret... "needs root".

I looked into this when I bought my Nexus 7 tablet. From what I
learned, basic Android users are "Standard" users, using Windows
terminology.

Unless things have changed, you will have to "root" your phone. That
simply means giving yourself "Administrator" rights. Never got abound
to doing it, since I could transfer from anywhere on the network to the
tablet.


--
Ken
Mac OS X 10.8.5
Firefox 44.0
Thunderbird 38.0.1
"My brain is like lightning, a quick flash
and it's gone!"

[Anda Lucite]

Ken Springer wrote in message na5usc$agg$1...@news.albasani.net

> Whiskers has the secret... "needs root".

I don't know yet if Whiskers has the secret because "my" Android
phone (which is NOT rooted!) can "see" all the devices on my network
(9 of 16) where the other 7 of 16 used to be on the network in the past.

So, Android can see *everything* without being root!
https://i.imgur.com/Szjbr5f.gif

How Android does that, I do not know.

By way of contrast, if I *log* into my router as "admin" (essentially
root), then I can see all the current devices, which are the same
as what Android sees.

> Unless things have changed, you will have to "root" your phone. That
> simply means giving yourself "Administrator" rights. Never got abound
> to doing it, since I could transfer from anywhere on the network to the
> tablet.

This is wrong.
Fing will show you EVERYTHING on your network (past and present), without
any need to be root!

Try it to see what I mean and post a screenshot.
Fing - Network Tools, by Overlook
https://play.google.com/store/apps/details?id=com.overlook.android.fing

HOW Android accomplishes what takes a router to be root is what I'm
trying to do either on Windows or on Linux.

[Anda Lucite]

Whiskers wrote in message
slrnncbpkd.v...@ID-107770.user.individual.net

> arp-scan - runs on Linux, needs root.

$ which arp-scan
/usr/bin/arp-scan

$ arp-scan --version
arp-scan 1.8.1

$ arp-scan
You need to be root, or arp-scan must be SUID root, to open a link-layer socket.
link_open: Operation not permitted

$ sudo arp-scan
ioctl: Cannot assign requested address
WARNING: Could not obtain IP address for interface eth0. Using 0.0.0.0 for
the source address, which is probably not what you want.
Either configure eth0 with an IP address, or manually specify the address
with the --arpspa option.
Interface: eth0, datalink type: EN10MB (Ethernet)
Usage: arp-scan [options] [hosts...]

$ sudo arp-scan --interface=wlan0 --localnet
Interface: wlan0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.8.1 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)
192.168.1.1 84:1b:5e:xx:xx:xx (Unknown)
192.168.1.3 00:18:61:xx:xx:xx Ooma, Inc.
192.168.1.7 00:1f:3b:xx:xx:xx Intel Corporate
192.168.1.2 5c:0a:5b:xx:xx:xx (Unknown)
192.168.1.5 40:b0:fa:xx:xx:xx (Unknown)
192.168.1.5 40:b0:fa:xx:xx:xx (Unknown) (DUP: 2)
192.168.1.116 00:10:83:xx:xx:xx HEWLETT-PACKARD COMPANY
192.168.1.200 00:16:b6:xx:xx:xx Cisco-Linksys

8 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.8.1: 256 hosts scanned in 1.543 seconds (165.91 hosts/sec). 8 responded


The good news is that arp-scan found many of the same devices that
Fing found in a scan at the very same time.

The really BAD NEWS is that arp-scan totally missed *all* the Apple
devices that were on my network - which Fing easily found!

[Paul]

"ARP versus ICMP/ping"

http://archive09.linux.com/feature/50596

"One possible drawback to this system of using ARP to ping
a host is that the ARP protocol is not a routed protocol.
If you are not on the same subnet as the host you are
trying to connect to, then this method is not going to
work without first joining that subnet, which may or may
not be physically possible."

Probably time for a Networking 101 class at
school, then get the instructor to cover
all the possibilities for you :-)

A purpose built tool, might need more than one method.
And if nameservers were involved (Bonjour, Avahi,
SSDP, NetBIOS, UPNP, DLNA, kitchen_sink), you might
actually need a daemon or DLL or something added to
the system, to aid in participation in the scheme.
So what you're looking for, a heterogenous solution,
might be a little more complicated to build, than
a solution that only needs to work with its own OS
partners.

Having a nameserver, allows perhaps determining what
services a device offers. Whether it's a printer
or a TV set that plays streamed movies.

Ping used to work fine, until someone considered it
a security risk, and servers started disabling ICMP.
There is partial or full disable-ment possible. For
example, my former ISP did such a good job, the
email server could no longer handle fragmented packets,
and you could only send very short emails (ones that
fit in a single packet). I was required to change the
maximum packet size on my end, to make email work again.
And the tech support at the ISP, swore up and down,
that their end had nothing to do with it :-)

I never took Networking 101. But I have known people
who have tried to study this stuff in detail. Our
masters grad at work, it took *two years* to assemble
a document listing all the protocols and a thumbnail
of details for each one. I never got to see the
resulting document. I'm sure he benefited from the effort,
paid for by our employer. Software architect class individuals
would use that document for product planning.

*******

The listing in your router, is the DHCP list.
Computing devices needing a dynamic address, use
a "lease" with the router. The router keeps a pool
of addresses for the purpose. It might be
reasonably complete, except for static addresses
you assign to devices, which is on the same subnet,
but outside the range of pool addresses. The
presence or absence (powered off) state of a
static device, wouldn't show up in the router list.

Some protocols, require the participants to "cache"
recently seen objects. For example, using Windows file
sharing, I can see references to items that are no longer
on the network. There will be some "wheel spinning"
on Windows, if it is required to try to find a
non-existent file sharing device. A disadvantage of
caching references to them.

And if I could find a decent article on heterogenous
environments, I would have pasted it into this
posting by now :-) I don't know if this is a
popular topic, or why any web site would bother
carrying the information needed. For example,
a Macintosh site is not likely to entertain articles
about Windows, or vice versa.

Paul

[John Hasler]

Anda Lucite writes:
> I don't know yet if Whiskers has the secret because "my" Android
> phone (which is NOT rooted!) can "see" all the devices on my network
> (9 of 16) where the other 7 of 16 used to be on the network in the past.

> So, Android can see *everything* without being root!

Aside from the fact that Android is not Linux, it's just a matter of
permissions.
--
John Hasler
jha...@newsguy.com
Dancing Horse Hill
Elmwood, WI USA

[Kirk_Von_Rockstein]

On 2016-02-19, Anda Lucite <andal...@andalucite.net> wrote:
<snip diatribe>

> $ sudo arp-scan --interface=wlan0 --localnet
> Interface: wlan0, datalink type: EN10MB (Ethernet)
> Starting arp-scan 1.8.1 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)
> 192.168.1.1 84:1b:5e:xx:xx:xx (Unknown)
> 192.168.1.3 00:18:61:xx:xx:xx Ooma, Inc.
> 192.168.1.7 00:1f:3b:xx:xx:xx Intel Corporate
> 192.168.1.2 5c:0a:5b:xx:xx:xx (Unknown)
> 192.168.1.5 40:b0:fa:xx:xx:xx (Unknown)
> 192.168.1.5 40:b0:fa:xx:xx:xx (Unknown) (DUP: 2)
> 192.168.1.116 00:10:83:xx:xx:xx HEWLETT-PACKARD COMPANY
> 192.168.1.200 00:16:b6:xx:xx:xx Cisco-Linksys
>
> 8 packets received by filter, 0 packets dropped by kernel
> Ending arp-scan 1.8.1: 256 hosts scanned in 1.543 seconds (165.91 hosts/sec). 8 responded
>
>
> The good news is that arp-scan found many of the same devices that
> Fing found in a scan at the very same time.
>
> The really BAD NEWS is that arp-scan totally missed *all* the Apple
> devices that were on my network - which Fing easily found!
>

Try these two commands from a root shell like so:

netdiscover -i wlan0 -r 192.168.1.0/24

nmap --script broadcast-dhcp-discover -p67 192.168.1.0/24

[Anda Lucite]

John Hasler wrote in message 87si0o9...@thumper.dhh.gt.org

> Aside from the fact that Android is not Linux, it's just a
> matter of permissions.

It's also a matter of "accuracy" as arp-cache seems to be terrible
at telling us what is on the network, root permissions notwithstanding.

The unrooted Android seems to have more "permission" than the
Linux root does (since Android can see Apple devices on the network
that even root Linux can't see using arp-cache).

The unrooted Android seems to have the *same* permission as the
admin account on the router in fact.

Even the unrooted iPad seems to have more permission than the root
account on Linux (since it also shows all the devices, including iPads).

That's amazing.

Is there a better Linux app than arp-cache that can actually "see"
what's on the network?

[Anda Lucite]

Paul wrote in message na70t0$t3$1...@dont-email.me

> I never took Networking 101.

Me neither. I wish they taught that in high school
instead of algebra.

> The listing in your router, is the DHCP list.

The router (as admin) is accurate.
The (unrooted) iPad (with Fing) is accurate.
The (unrooted) Android (with Fing) is accurate.

Yet, the (root) arp-cache on Linux is missing all my
iPads!

The question is what Linux program (or Windows) can
list *all* the devices on the network?

[John Hasler]

Anda Lucite writes:
> Even the unrooted iPad seems to have more permission than the root
> account on Linux (since it also shows all the devices, including iPads).

> That's amazing.

> Is there a better Linux app than arp-cache that can actually "see"
> what's on the network?

I don't have arp-cache but any arp tool is only going to show you stuff
that is on the local network segment because it only deals in MAC
addresses.

You want Nmap:

Package: nmap
Version: 7.01-2
Installed-Size: 21.5 MB
Maintainer: Hilko Bengen <ben...@debian.org>
Depends: libc6 (>= 2.15), libgcc1 (>= 1:3.0), liblinear3 (>= 2.01+dfsg), liblua5.2-0, libpcap0.8 (>= 0.9.8), libpcre3 (>= 1:8.35), libssl1.0.2 (>= 1.0.2d), libstdc++6 (>= 5.2), lua-lpeg
Recommends: ndiff
Homepage: http://nmap.org/
Tag: admin::monitoring, implemented-in::c, interface::commandline,
network::scanner, role::program, scope::utility, use::scanning
Section: net
Priority: extra
Download-Size: 4,879 kB
APT-Sources: http://debian.csail.mit.edu/debian/ sid/main amd64 Packages
Description: The Network Mapper
Nmap is a utility for network exploration or security auditing. It
supports ping scanning (determine which hosts are up), many port
scanning techniques, version detection (determine service protocols
and application versions listening behind ports), and TCP/IP
fingerprinting (remote host OS or device identification). Nmap also
offers flexible target and port specification, decoy/stealth scanning,
sunRPC scanning, and more. Most Unix and Windows platforms are
supported in both GUI and commandline modes. Several popular handheld
devices are also supported, including the Sharp Zaurus and the iPAQ.

[Anda Lucite]

Kirk_Von_Rockstein wrote in message dioker...@mid.individual.net

> Try these two commands from a root shell like so:
>
> netdiscover -i wlan0 -r 192.168.1.0/24

Here is another result from Fing on unrooted Android:
https://i.imgur.com/8K9xbW4.gif

Here is the comparable result from netdiscover on Linux:
https://i.imgur.com/tVIGY6N.gif

$ netdiscover -i wlan0 -r 192.168.1.0/24
The program 'netdiscover' is currently not installed.
You can install it by typing: sudo apt-get install netdiscover

$ sudo apt-get install netdiscover
$ netdiscover -i wlan0 -r 192.168.1.0/24
You must be root to run this.

$ sudo netdiscover -i wlan0 -r 192.168.1.0/24
https://i.imgur.com/tVIGY6N.gif

The results are anomalous in that the Apple device showed
up on both tests this time, but not all Android devices
showed up on the Linux test.

So, once again, the iOs/Android Fing shows *more* devices
on the network than did Linux/Windows.

Still, it's an improvement over arp-cache!

[Anda Lucite]

Kirk_Von_Rockstein wrote in message dioker...@mid.individual.net

> Try these two commands from a root shell like so:

> nmap --script broadcast-dhcp-discover -p67 192.168.1.0/24

The nmap program, run as the user, suffered a similar fate
in that it found 7 devices on the network:
192.168.{1,2,5,8,11,116,200)
https://i.imgur.com/sSx7ue5.gif

Whereas Fing run on an unrooted Android at the same time
found 11 devices on the network:
192.168.{1,2,3,4,5,6,7,8,11,116,200)
https://i.imgur.com/x86hXcc.gif

Both devices were next to each other, and both were run at
the same time, both as the regular user.

Why "Fing" on iOS/Android finds *more* devices than anything
yet on Linux or Windows is beyond my comprehension.

[Anda Lucite]

John Hasler wrote in message 87k2m08...@thumper.dhh.gt.org

> I don't have arp-cache but any arp tool is only going to show you stuff
> that is on the local network segment because it only deals in MAC
> addresses.
>
> You want Nmap:

The nmap program, run as the user, suffered a similar fate

in that it only found 7 devices on the network:
192.168.1.{1,2,5,8,11,116,200)

https://i.imgur.com/sSx7ue5.gif

Whereas Fing run on an unrooted Android at the same time
found 11 devices on the network:

192.168.1.{1,2,3,4,5,6,7,8,11,116,200)

https://i.imgur.com/x86hXcc.gif

Both devices were next to each other, and both were run at
the same time, both as the regular user.

Yet Fing found 4 devices that nmap couldn't find:
192.168.1.{3,4,6,7)

3 = Ooma
4 = Apple
6 = Apple
7 = Windows

[John Hasler]

Run Nmap as root. Read the man page first so that you will now what
options to use.

[Anda Lucite]

John Hasler wrote in message 87fuwo8...@thumper.dhh.gt.org

> Run Nmap as root. Read the man page first so that you will now what
> options to use.

Makes no difference.

[Whiskers]

On 2016-02-19, Anda Lucite <andal...@andalucite.net> wrote:

Try different settings for the arp-scan --retry= and --timeout=
options. If a device is on your local subnet then it will be scanned by
arp-scan - but isn't obliged to respond so perhaps Apple devices just
don't want to play. I have no ithings to test.

[Paul]

Anda Lucite wrote:

>
> The question is what Linux program (or Windows) can
> list *all* the devices on the network?

Any method that will work, will need to use
multiple methods. While a single, simple method
will "mainly" work, it's the exception cases
that need to be covered with more methods.

Try to track down the source code for any
program (on any platform), that is doing
a good job for you. Check the comments in
the code, to see how many network features
it is using to identify all devices.
That's the best I can suggest, to get
a handle on what alternate set of tools
might work.

Paul

[Marek Novotny]

On 2016-02-19, Whiskers <catwh...@operamail.com> wrote:
> Try different settings for the arp-scan --retry= and --timeout=
> options. If a device is on your local subnet then it will be scanned by
> arp-scan - but isn't obliged to respond so perhaps Apple devices just
> don't want to play. I have no ithings to test.

#!/bin/bash

#################################################
#
# script: myscan
# version: .01
# date: 2016-02-19
# by: Marek Novotny
# dependency: sudo, ip, app-scan
# notes:
#
#################################################

dependencies () {
array=(ip sudo arp-scan)
for x in ${array[@]} ; do
which $x &> /dev/null
if [ $? -ne 0 ] ; then
echo "$(basename $0) Error: Missing dependency, ${x}..."
exit $?
fi
done
}

setSudo () {
if [ $(id -u) -ne 0 ] ; then
priv=sudo
else
priv=""
fi
}

dependencies
setSudo

set -- $(ip route get 8.8.8.8)
defaultDev=$5

set -x
$priv arp-scan --interface=$defaultDev --localnet
set +x

# END

$ myscan | grep -i apple

192.168.1.9 3c:07:54:30:d3:9e Apple Inc
192.168.1.71 00:11:24:6e:d8:ee Apple Computer
192.168.1.113 00:1d:4f:49:3c:25 Apple Computer Inc.
192.168.1.118 00:17:f2:0b:1d:4a Apple Computer
192.168.1.221 3c:07:54:67:0f:e4 Apple Inc

--
Marek Novotny
https://github.com/marek-novotny

[Anda Lucite]

Marek Novotny wrote in message
XpOdnZq8b4H37FrL...@giganews.com

> $ myscan | grep -i apple
>
> 192.168.1.9 3c:07:54:30:d3:9e Apple Inc
> 192.168.1.71 00:11:24:6e:d8:ee Apple Computer
> 192.168.1.113 00:1d:4f:49:3c:25 Apple Computer Inc.
> 192.168.1.118 00:17:f2:0b:1d:4a Apple Computer
> 192.168.1.221 3c:07:54:67:0f:e4 Apple Inc

Nice utility!

$ myscan.sh
+ sudo arp-scan --interface=wlan0 --localnet

Interface: wlan0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.8.1 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)
192.168.1.1 84:1b:5e:xx:xx:xx (Unknown)
192.168.1.3 00:18:61:xx:xx:xx Ooma, Inc.

192.168.1.2 5c:0a:5b:xx:xx:xx (Unknown)
192.168.1.7 00:1f:3b:xx:xx:xx Intel Corporate

192.168.1.116 00:10:83:xx:xx:xx HEWLETT-PACKARD COMPANY
192.168.1.200 00:16:b6:xx:xx:xx Cisco-Linksys

192.168.1.6 8c:29:37:xx:xx:xx (Unknown)

192.168.1.5 40:b0:fa:xx:xx:xx (Unknown)

8 packets received by filter, 0 packets dropped by kernel

Ending arp-scan 1.8.1: 256 hosts scanned in 1.437 seconds (178.15 hosts/sec). 8 responded
+ set +x

Looking at Fing results on Android, 192.168.1.6 is an Apple iPad Air
which shows up as "Unknown".

[Paul]

Are you certain there are actually 11 devices ?
For DHCP address assignment, a "pretty neat" job
was done in the second example. Looks too orderly.

*******

Both Fing and Nmap use TCP SYN (half open connections),
but they may not be using the same ports, or scanning
ports in the same order. Fing apparently does
something very simple, for the network map, and
then resorts to scanning more ports to
build a service map. (In such a case, relying
on well known port values that haven't shifted,
to identify a service.)

http://www.networkuptime.com/nmap/page3-2.shtml

Some device network interfaces recognize port scans,
and if a scan pattern is "hammered" at the device,
a large number of packets end up dropped on the floor.
This is why, with my previous router, I could never
be sure whether it was stealthy or not, because the
router would claim to be under attack, and an unknown
amount of WAN (port scanner) traffic was being ignored.

If you fired up Wireshark on a platform it supports,
and let the two scanning tools loose, you may be able
to compare the approach used, and why they differ in
effectiveness.

Paul

[William Unruh]

On 2016-02-19, Anda Lucite <andal...@andalucite.net> wrote:

> John Hasler wrote in message 87si0o9...@thumper.dhh.gt.org
>
>> Aside from the fact that Android is not Linux, it's just a
>> matter of permissions.
>
> It's also a matter of "accuracy" as arp-cache seems to be terrible
> at telling us what is on the network, root permissions notwithstanding.
>
> The unrooted Android seems to have more "permission" than the
> Linux root does (since Android can see Apple devices on the network
> that even root Linux can't see using arp-cache).

Nope. The arp cache is stuff that the machine has acrually talked with
in the last little while. Ie also decays (ie stuff drops off after a
while).

You can always take every address on the network, send out a ping to it,
and thus know if it is there.

>
> The unrooted Android seems to have the *same* permission as the
> admin account on the router in fact.

So what?

>
> Even the unrooted iPad seems to have more permission than the root
> account on Linux (since it also shows all the devices, including iPads).

So what?
>
> That's amazing.

No, it is not amazing.

>
> Is there a better Linux app than arp-cache that can actually "see"
> what's on the network?

It "sees" what it actually talks to. Get it to talk to everything and it
will be in the cache.

The router of course talks to everything. The andriod might talk to
everthing in the background.
Who cares?

[Jasen Betts]

On 2016-02-19, Anda Lucite <andal...@andalucite.net> wrote:

that looks like the results of some sort of scan, have you tried nmap.


--
\_(ツ)_

[Jasen Betts]

On 2016-02-18, Anda Lucite <andal...@andalucite.net> wrote:
> How does my Android phone figure out what's on my network
> without logging into the home router?

probably "Avahi"

--
\_(ツ)_

[Anda Lucite]

William Unruh wrote in message na8c5f$c8o$1...@dont-email.me

> Who cares?

You would care if you wanted to know everything that was on your
network, and you couldn't get the answer from your Linux or Windows
machine.

[Anda Lucite]

Jasen Betts wrote in message na8i5f$8a9$4...@gonzo.alcatraz

> that looks like the results of some sort of scan, have you tried nmap.

The nmap program, run as the user, suffered a similar fate

in that it only found 7 devices on the network:
192.168.1.{1,2,5,8,11,116,200)

https://i.imgur.com/sSx7ue5.gif

Whereas Fing run on an unrooted Android at the same time
found 11 devices on the network:

192.168.1.{1,2,3,4,5,6,7,8,11,116,200)

https://i.imgur.com/x86hXcc.gif

Both devices were next to each other, and both were run at
the same time, both as the regular user.

[William Unruh]

I would know because I put it onto my network.

[Anda Lucite]

Paul wrote in message na8433$em3$1...@dont-email.me

> Are you certain there are actually 11 devices ?

I recognize every one of them.

> For DHCP address assignment, a "pretty neat" job
> was done in the second example. Looks too orderly.

What does "too orderly" mean?
nmap found 192.168.{1,2,5,8,11,116,200)
https://i.imgur.com/sSx7ue5.gif

Fing found 192.168.{1,2,3,4,5,6,7,8,11,116,200)
https://i.imgur.com/x86hXcc.gif

It's just a screenshot of the results.
What does "too orderly" mean?

[Anda Lucite]

Jasen Betts wrote in message na8hrn$8a9$3...@gonzo.alcatraz

> probably "Avahi"

I had never heard of "Avahi" before.
http://fixunix.com/networking/328831-what-avahi-daemon.html

Apple originated the idea - as "Rendezvous" or "Bonjour" in 1997. The
idea was for those times when two people met somewhere, and wanted to
trade files without having a real network available. See the original
version of draft-ietf-zeroconf-ipv4-linklocal-01.txt from November
2000.

Microsoft thought the concept was great, as it allowed systems to
work when the MSCE (or the average user) had so screwed up the network
configurations that even windoze wouldn't work - and this was added to
win98. Microsoft joined the linklocal working group in 2001 so that
their version would be considered.

Sun (actually Sun Germany) joined later still, but it appears they
were adding sanity checking. Compare the linklocal-04 and
linklocal-07 releases of the draft. For what it's worth, there were
other companies represented on the linklocal working group, such as
Motorola. The main result of this collaboration was RFC3927.

3927 Dynamic Configuration of IPv4 Link-Local Addresses. S. Cheshire,
B. Aboba, E. Guttman. May 2005. (Format: TXT=83102 bytes)
(Status: PROPOSED STANDARD)

But this didn't deal with name resolution. For that, Apple and
microsoft came up with incompatible solutions, using different IP
addresses and port numbers[1] and even different packet formats. These
were documented in two additional draft families -
draft-ietf-dnsext-mdns from microsoft went through (at least) 47
releases before being introduced as an INFORMATION RFC (RFC4795 - which
describes how it works, but doesn't specify anything meant as a
standard), while Apple worked on draft-cheshire-dnsext-multicastdns
which went through six releases before disappearing). Avahi is one of
several free implementations of the Apple proposal, and therefore isn't
compatible with the windoze version (you'd need to be running Samba and
NETBIOS name resolution for windoze). Both Apple and microsoft warn
that the name service is insecure, suggest different name limitations[2]
though intentionally ignoring those limits, and then drop the fireball
into your lap by saying that you should use some other security
mechanism, but neither bother to include ANY such mechanism.

Old guy
[1] Apple used 224.0.0.251 or its IPv6 equivalent FF02::FB and port
5353, while microsoft uses 224.0.0.252 or its IPv6 equivalent
FF02::1:3 and port 5355.

[2] Apple proposed limiting name resolution to names ending in .local
ONLY, while microsoft proposed using "single-label names" (which is
win-babble for names without a 'dot'). Neither actually implemented
these limitations because they knew lusers would not follow these
limits even if they were aware of them.

[Anda Lucite]

Jasen Betts wrote in message na8hrn$8a9$3...@gonzo.alcatraz

>
> probably "Avahi"

More on Avahi.
http://www.linuxplanet.com/linuxplanet/reports/6826/1

avahi is installed by default on Debian and Ubuntu systems, but few
people seem to use it to any extent. It's supposed to be a service auto-
discovery, but what services exactly is it set up to discover? I decided
to take a look and figure out if I could actually make it do something I
wanted.

avahi runs mDNS plus DNS-SD: that is, multicast DNS plus DNS service
discovery. Multicast DNS means that each equipped host stores its own DNS
records. A multicast address (224.0.0.251) is used by clients wishing to
get the IP address of a given hostname, and that host responds to the
client request with its IP address. DNS-SD uses the same technology, but
in addition to regular DNS information, hosts also publish service
instance information: they announce what services they provide and how to
contact those services. All of this is intended to mean that hosts and
services can connect to one another without requiring any user
configuration: known as Zeroconf sharing. Great for those who aren't
comfortable doing manual setup -- or who are just lazy!

In truth, as yet there isn't that much Linux software that really uses
mDNS. Apple have made rather more use of it: their software is called
Bonjour, and handles printer setup, music sharing via iTunes, photo
sharing via iPhoto, Skype, iChat, and an array of other software
services. However, in terms of the technical implementation, avahi is an
excellent piece of software, and capable of doing everything that Bonjour
does. It's been suggested that the Debian/Ubuntu dev teams are actually
trying to help give mDNS a bit of encouragement with the inclusion of
avahi.

So, what can you do with avahi on your Linux box? One possibility is to
use it for networked music sharing. In particular, if some of your music
is on laptops that appear and disappear from the network as they are
moved around and shut down or booted up, auto music discovery is very
handy. This is the same tech that Apple uses for iTunes. Since I have a
Mac laptop and a couple of Debian desktops which live in another room,
this sounded promising.

[Anda Lucite]

William Unruh wrote in message na8r4p$5j6$1...@dont-email.me

> I would know because I put it onto my network.

You realize how dumb that sounds, don't you?

[Jasen Betts]

On 2016-02-19, Anda Lucite <andal...@andalucite.net> wrote:

if you only want to find the devices fing finds do an arp scan.
if you want to find all devices attached to your network (including
those fing does not find) you could try a MAC scan, but you'd
die before it completed.


--
\_(ツ)_

[Jasen Betts]

On 2016-02-19, John Hasler <jha...@newsguy.com> wrote:
> Anda Lucite writes:
>> Even the unrooted iPad seems to have more permission than the root
>> account on Linux (since it also shows all the devices, including iPads).
>
>> That's amazing.
>
>> Is there a better Linux app than arp-cache that can actually "see"
>> what's on the network?
>
> I don't have arp-cache but any arp tool is only going to show you stuff
> that is on the local network segment because it only deals in MAC
> addresses.
>

You can run arping as non-root,but it doesn't include the list of
MAC-to-maker translations that the other tools have.

--
\_(ツ)_

[Jasen Betts]

On 2016-02-19, Anda Lucite <andal...@andalucite.net> wrote:

> John Hasler wrote in message 87k2m08...@thumper.dhh.gt.org
>
>> I don't have arp-cache but any arp tool is only going to show you stuff
>> that is on the local network segment because it only deals in MAC
>> addresses.
>>
>> You want Nmap:
>
> The nmap program, run as the user, suffered a similar fate
> in that it only found 7 devices on the network:
> 192.168.1.{1,2,5,8,11,116,200)
> https://i.imgur.com/sSx7ue5.gif

nmap looks for ICMP or TCP/IP servers, if after running nmap you look
in the arp cache you'll likely see the other devices.

> Whereas Fing run on an unrooted Android at the same time
> found 11 devices on the network:
> 192.168.1.{1,2,3,4,5,6,7,8,11,116,200)
> https://i.imgur.com/x86hXcc.gif

Fing performs an ARP scan on each address in the local address
range if you have stuff on your LAN that's not using an IP address in
that range it won't be found.

> Both devices were next to each other, and both were run at
> the same time, both as the regular user.
>
> Yet Fing found 4 devices that nmap couldn't find:
> 192.168.1.{3,4,6,7)
>
> 3 = Ooma
> 4 = Apple
> 6 = Apple
> 7 = Windows

yeah, nmap wan't looking.

--
\_(ツ)_

[Paul]

When DHCP assigns addresses, it assigns them out
of a pool of addresses. As devices or OSes disappear,
the DHCP server remembers some of the assignments, and
won't (immediately) reuse the number. It's just
pretty amazing that it used 1,2,3,4,5,6,7,8 to
assign eight of them in a row. My DHCP here, I can't
rely on them being in order (there should be a bit
more fragmentation). There would be "holes", as my
machines run more than one OS, and the assignment is
going to change (or even screw up) if I boot a different
OS. For example, sometimes I have address conflicts,
and have to "release" and "renew" the DHCP lease.

Paul

[pedro]

On Sat, 20 Feb 2016 03:44:08 -0500, Paul <nos...@needed.com> wrote:

(snip)

>There would be "holes", as my
>machines run more than one OS, and the assignment is
>going to change (or even screw up) if I boot a different
>OS.

Why would the DHCP server see the machine's network interface
differently after a reboot (whether into a different OS or not)?

Surely all it sees is a request to assign an IP address from a MAC
address (of the NIC). In that case it simply checks the pool and
unexpired leases, and if it finds a MAC-match it renews that old
assignment with a fresh expiry. That is my experience.

[Anda Lucite]

pedro wrote in message 9rdicblvdlj7jdvoq...@4ax.com

> Why would the DHCP server see the machine's network interface
> differently after a reboot (whether into a different OS or not)?
>
> Surely all it sees is a request to assign an IP address from a MAC
> address (of the NIC). In that case it simply checks the pool and
> unexpired leases, and if it finds a MAC-match it renews that old
> assignment with a fresh expiry. That is my experience

This brings up a good question which has always bothered me in the back
of my head.

Whenever we have "network" issues, the support personal invariable suggest
that we power everything down, and then we connect everything back up,
one by one, 30 seconds per device, starting at the wall.

That is, they suggestion something like this:
1. Power everything down (pulling the actual power cord out).
2. Power up the modem (waiting a full 30 seconds at a minimum).
3. Power up the router (waiting the full 30 seconds or more to boot).
3. Power up each wired device in turn (desktop & printer & ooma) individually.
4. Also individually power up the wireless devices (laptop & phones & ipads).

It seems that, after doing that countless times, sometimes the devices
get the old IP address; sometimes they get a new IP address; and sometimes
I see (usually on the wired desktop) a message that there is an IP address
conflict.

Does any of that make sense to you from a networking standpoint.

[Whiskers]

On 2016-02-18, Anda Lucite <andal...@andalucite.net> wrote:
> How does my Android phone figure out what's on my network without
> logging into the home router?
>

> I can see 8 devices on the network when I log into the admin account
> of the router using a web browser on a laptop.
>
> However, I can see all those devices from my Android phone WITHOUT
> logging into the router, simply by using "Fing" Android freeware:
> https://i.imgur.com/Szjbr5f.gif
>
> My question?
>
> How does the phone see both wired & wireless devices (such as a wired
> printer & a wired Ooma) without logging into the router?
>
> More importantly, how can I get Windows & Linux to see the same 8 or 9
> devices on my network that the phone sees *without* logging into the
> router's admin account?

It seems that there are versions of the Fing app available for desktop
operating systems too <https://www.fingbox.com/download>. The 'Fing for
Linux' option lists

RPM 64 Bit or 32 Bit
DEB 64 Bit or 32 Bit
TGZ 64 Bit or 32 Bit

there may already be a 'build' of the tarball for your distro (possibly
in the 'testing' or 'user-contributed' or other 'unofficial'
repositories).

[Big Al]

There isn't in Linux Mint 17.3 Cinnamon. I was hoping. But I can
download the deb sure.

[William Unruh]

And why should there be? It is operating down at a low level where all
distros are the same. The important thing is your package manager. If it
uses deb, then use the DEB package.

>

[Anda Lucite]

Whiskers wrote in message
slrnncjit5.q...@ID-107770.user.individual.net

> It seems that there are versions of the Fing app available for desktop
> operating systems too <https://www.fingbox.com/download>. The 'Fing for
> Linux' option lists

The web page was nicely set up in that it provided the URL:
$ wget "https://www.fingbox.com/download?plat=lx64&ext=deb"

$ ls -l
-rw------- 1 anda anda 6813808 Feb 21 12:58 download?plat=lx64&ext=deb

$ file down*
download?plat=lx64&ext=deb: Debian binary package (format 2.0)

$ md5sum dow*
438145234207ffd08bb42a808d798eea download?plat=lx64&ext=deb

$ sudo dpkg -i download?plat=lx64
dpkg: error processing archive download?plat=lx64 (--install):
cannot access archive: No such file or directory
Errors were encountered while processing:
download?plat=lx64

$ mv "download?plat=lx64&ext=deb" fing_lx64.deb
$ sudo dpkg -i ./fing_lx64.deb
Selecting previously unselected package fing.
(Reading database ... 363292 files and directories currently installed.)
Preparing to unpack ./fing_lx64.deb ...
Unpacking fing (3.0) ...
Setting up fing (3.0) ...

$ which fing
/usr/bin/fing

$ file $(which fing)
/usr/bin/fing: POSIX shell script, ASCII text executable

$ cat $(which fing)
#!/bin/sh
#
# Copyright 2015 by Overlook

export LD_LIBRARY_PATH="/usr/local/lib/fing"
export DYLD_LIBRARY_PATH=$LD_LIBRARY_PATH

ulimit -n 1024
ulimit -c unlimited

/usr/local/lib/fing/fing.bin $@

$ fing
Fing init error while creating folder: boost::filesystem::create_directory: Permission denied: "/var/log/fing"
Fing init error while creating folders and conf: boost::filesystem::create_directory: Permission denied: "/etc/fing"
[overlook.util.logging.FileHandler] unable to open output file </var/log/fing/fing-20160221.130812.log>
Error: no network interface detected
please make sure you have administrative rights.

$ sudo fing
13:08:37 > Discovery profile: Default discovery profile
13:08:37 > Discovery class: data-link (data-link layer)
13:08:37 > Discovery on: 192.168.1.0/24

13:08:37 > Discovery round starting.
13:08:37 > Discovery error: unable to select a valid network interface to use
------ control c -------

$ man fing
No manual entry for fing
See 'man 7 undocumented' for help when manual pages are not available.

$ fing --help

=== overlook fing 3.0 - www.overlooksoft.com ===

Command line options:
-h [ --help ] show this help message
-v [ --version ] show fing version
-i [ --info ] show network informations
-n [ --netdiscover ] arg run network discovery
-s [ --servicescan ] arg run service scan on host/network
-o [ --output ] arg use output setup for discovery/scan/ping
-P [ --profile ] arg use specific discovery/scan/ping profile
-d [ --rdns ] arg enable/disable reverse DNS lookups
-r [ --rounds ] arg number of rounds (network discovery)
--session arg use specific discovery session file
--silent force to silent mode
--interactive start the interactive mode
-p [ --ping ] arg run icmp ping on the hosts
--sentinel run Fingbox Sentinel
-w [ --wol ] arg send wake on lan on targets

Error: no network interface detected
please make sure you have administrative rights.

$ sudo fing -n
Error: required parameter is missing in 'netdiscover'
INFO 2016/02/21 13:14:07 fing graceful exit.

$ sudo fing -I wlan0
Error: unknown option -I
INFO 2016/02/21 13:13:37 fing graceful exit.

$ sudo fing -s
Error: required parameter is missing in 'servicescan'
INFO 2016/02/21 13:15:05 fing graceful exit.


$ sudo fing -s localhost
13:15:51 > Service scan on: localhost (127.0.0.1)

13:15:51 > Service scan starting.
13:15:51 > Detected service: 53 (domain)
13:15:51 > Detected service: 22 (ssh)
13:15:51 > Detected service: 21 (ftp)
13:15:52 > Detected service: 119 (nntp)
13:15:52 > Detected service: 139 (netbios-ssn)
13:15:52 > Detected service: 445 (microsoft-ds)
13:15:52 > Detected service: 631 (ipp)
13:15:52 > Detected service: 953 (rndc)
13:15:52 > Detected service: 8118 (privoxy)
13:15:52 > Service scan completed in 0.049 seconds.

-------------------------------------------------------------------------------
| Scan result for localhost (127.0.0.1) |
|-----------------------------------------------------------------------------|
| Port | Service | Description |
|-----------------------------------------------------------------------------|
| 21 | ftp | File Transfer Protocol |
| 22 | ssh | SSH Secure Shell |
| 53 | domain | Domain Name Server |
| 119 | nntp | Network News Transfer Protocol |
| 139 | netbios-ssn | NETBIOS Session Service |
| 445 | microsoft-ds | SMB directly over IP |
| 631 | ipp | Internet Printing Protocol -- for one implementat |
| 953 | rndc | RNDC is used by BIND 9 (& probably other NS) |
| 8118 | privoxy | Privoxy, www.privoxy.org |
-------------------------------------------------------------------------------

$ sudo fing -n localhost
Error: in provided network: invalid argument
Please provide network in format: address/len.
E.g.: 192.168.0.1/24 which is a common class C LAN range.
E.g.: www.over-look.com/24 which is an internet class C LAN range.

$ sudo fing -n 192.168.1.1/24
13:17:29 > Discovery profile: Default discovery profile
13:17:29 > Discovery class: data-link (data-link layer)
13:17:29 > Discovery on: 192.168.1.0/24

13:17:29 > Discovery round starting.
13:17:29 > Discovery error: unable to select a valid network interface to use
--------control c---------

Well, I'm getting nowhere so, I'll ask how to use it and google some too.

How do I use fing on a typical linux computer on a home network?

[William Unruh]

On 2016-02-21, Anda Lucite <andal...@andalucite.net> wrote:
> Whiskers wrote in message
> slrnncjit5.q...@ID-107770.user.individual.net
>
>> It seems that there are versions of the Fing app available for desktop
>> operating systems too <https://www.fingbox.com/download>. The 'Fing for
>> Linux' option lists
>
> The web page was nicely set up in that it provided the URL:
> $ wget "https://www.fingbox.com/download?plat=lx64&ext=deb"

Many many errors that could have been avoided but he finally learned.

> $ cat $(which fing)
> #!/bin/sh
> #
> # Copyright 2015 by Overlook
>
> export LD_LIBRARY_PATH="/usr/local/lib/fing"
> export DYLD_LIBRARY_PATH=$LD_LIBRARY_PATH
>
> ulimit -n 1024
> ulimit -c unlimited
>
> /usr/local/lib/fing/fing.bin $@

So the key file is in /usr/local/lib/fing/fing.bin

>
> $ sudo fing -n 192.168.1.1/24
> 13:17:29 > Discovery profile: Default discovery profile
> 13:17:29 > Discovery class: data-link (data-link layer)
> 13:17:29 > Discovery on: 192.168.1.0/24
>
> 13:17:29 > Discovery round starting.
> 13:17:29 > Discovery error: unable to select a valid network interface to use
> --------control c---------

What does
route -n
tell you? Does network 192.168.1.0/24 exist?
What does
ifconfig -a
say?

It cannot find your network. That could mean many things. It could be
incompetently written. It could be you have no network.

Note it worked for me-- wired network

It would be a lot better if it actually had source code. One could
figure out what it was doing.

[Anda Lucite]

William Unruh wrote in message nadffb$dr$1...@dont-email.me

> What does
> route -n
> tell you? Does network 192.168.1.0/24 exist?

It works now that I have the syntax figured out!
https://i.imgur.com/XsnyHJx.gif

Linux FINALLY matches what Android & iOS reported all along!

Thanks for suggesting Fing on Linux/Windows for listing out all
the connected network devices.

Not a single other Linux or Windows command worked to date.

$ sudo fing -n 192.168.1.0/24 -r 1
15:30:03 > Discovery profile: Default discovery profile
15:30:03 > Discovery class: data-link (data-link layer)
15:30:03 > Discovery on: 192.168.1.0/24

15:30:03 > Discovery round starting.
15:30:03 > Host is up: 192.168.1.11
HW Address: 00:80:05:AA:43:55 (CACTUS COMPUTER)
Hostname: anda

15:30:03 > Host is up: 192.168.1.1
HW Address: 84:1B:5E:CC:A3:FF (Netgear)
Hostname: router

15:30:04 > Discovery progress 25%
15:30:05 > Discovery progress 50%
15:30:06 > Discovery progress 75%
15:30:03 > Host is up: 192.168.1.3
HW Address: 00:18:61:00:A4:CE (Ooma)

15:30:03 > Host is up: 192.168.1.9
HW Address: F8:D0:AC:DD:5A:FF (Sony)

15:30:03 > Host is up: 192.168.1.10
HW Address: 00:14:22:FF:56:31 (Dell)

15:30:03 > Host is up: 192.168.1.5
HW Address: 40:B0:FA:88:33:A1

15:30:03 > Host is up: 192.168.1.8
HW Address: 40:B0:FA:88:33:A1

15:30:03 > Host is up: 192.168.1.2
HW Address: 5C:0A:5B:C4:22:51 (Samsung)

15:30:03 > Host is up: 192.168.1.4
HW Address: 00:1F:3B:AA:D0:4A (Intel)

15:30:04 > Host is up: 192.168.1.116
HW Address: 00:10:83:00:8A:FF (HP)

15:30:04 > Host is up: 192.168.1.200
HW Address: 00:16:B6:53:66:91 (Cisco-Linksys)

---------------------------------------------------------------
| State | Host | MAC Address | Last change |
|-------------------------------------------------------------|
| UP | 192.168.1.1 | 84:1B:5E:CC:A3:FF | |
| UP | 192.168.1.2 | 5C:0A:5B:C4:22:51 | |
| UP | 192.168.1.3 | 00:18:61:00:A4:CE | |
| UP | 192.168.1.4 | 00:1F:3B:AA:D0:4A | |
| UP | 192.168.1.5 | 40:B0:FA:88:33:A1 | |
| UP | 192.168.1.8 | 40:B0:FA:88:33:A1 | |
| UP | 192.168.1.9 | F8:D0:AC:DD:5A:FF | |
| UP | 192.168.1.10 | 00:14:22:FF:56:31 | |
| UP | 192.168.1.11 | 00:80:05:AA:43:55 | |
| UP | 192.168.1.116 | 00:10:83:00:8A:FF | |
| UP | 192.168.1.200 | 00:16:B6:53:66:91 | |
---------------------------------------------------------------

15:30:49 > Discovery round completed in 45.527 seconds.
15:30:49 > Network 192.168.1.0/24 has 11/11 hosts up.

15:30:17 > Host is up: 192.168.1.6
HW Address: 8C:29:37:AA:21:22

Notice that Android phone (192.168.1.5 & 192.168.1.8) has two IP
addresses!

Here is the fing result on the phone at the same time!
https://i.imgur.com/XsnyHJx.gif

Finally they match!

[Anda Lucite]

Whiskers wrote in message
slrnncjit5.q...@ID-107770.user.individual.net

> It seems that there are versions of the Fing app available for desktop
> operating systems too <https://www.fingbox.com/download>. The 'Fing for
> Linux' option lists
>
> RPM 64 Bit or 32 Bit
> DEB 64 Bit or 32 Bit
> TGZ 64 Bit or 32 Bit
>
> there may already be a 'build' of the tarball for your distro (possibly
> in the 'testing' or 'user-contributed' or other 'unofficial'
> repositories).

Thanks Whiskers for figuring out how to finally list all the devices
on the network from the desktop/laptop computer.
https://www.fingbox.com/download

This worked:
$ wget "https://www.fingbox.com/download?plat=lx64&ext=deb"

$ mv "download?plat=lx64&ext=deb" fing_lx64.deb
$ sudo dpkg -i ./fing_lx64.deb

$ sudo fing -n 192.168.1.0/24 -r 1

Here is the result on the unrooted mobile phone:
https://i.imgur.com/XsnyHJx.gif

Here is the result on the desktop/laptop:

---------------------------------------------------------------
| State | Host | MAC Address | Last change |
|-------------------------------------------------------------|
| UP | 192.168.1.1 | 84:1B:5E:CC:A3:FF | |
| UP | 192.168.1.2 | 5C:0A:5B:C4:22:51 | |
| UP | 192.168.1.3 | 00:18:61:00:A4:CE | |
| UP | 192.168.1.4 | 00:1F:3B:AA:D0:4A | |
| UP | 192.168.1.5 | 40:B0:FA:88:33:A1 | |
| UP | 192.168.1.8 | 40:B0:FA:88:33:A1 | |
| UP | 192.168.1.9 | F8:D0:AC:DD:5A:FF | |
| UP | 192.168.1.10 | 00:14:22:FF:56:31 | |
| UP | 192.168.1.11 | 00:80:05:AA:43:55 | |
| UP | 192.168.1.116 | 00:10:83:00:8A:FF | |
| UP | 192.168.1.200 | 00:16:B6:53:66:91 | |
---------------------------------------------------------------

These failed to report *all* devices (hence they're useless):
$ sudo netdiscover -i wlan0 -r 192.168.1.0/24
$ sudo arp-scan --interface=wlan0 --localnet

Now we finally have a way to list *all* the devices on the network!

[William Unruh]

Of course it is also a closed source program, as far as I can see, so
for all we know, it reports all those devices back "home"

[Anda Lucite]

Anda Lucite wrote in message nadion$ceg$1...@news.mixmin.net

William Unruh wrote in message nadjr9$gmq$1...@dont-email.me

>> Now we finally have a way to list *all* the devices on the network!
>
> Of course it is also a closed source program, as far as I can see, so
> for all we know, it reports all those devices back "home"

I'd be glad to use an open-source program, if it just did the job
of listing *all* the devices on the network.

Since both the following FAILED to list all known devices, you can't
trust them to list ANY devices.

$ sudo netdiscover -i wlan0 -r 192.168.1.0/24
$ sudo arp-scan --interface=wlan0 --localnet

If there was a better program than Fing on Linux/Windows for listing
all devices, it's not known what it is.

[Anda Lucite]

William Unruh wrote in message nadjr9$gmq$1...@dont-email.me

> Of course it is also a closed source program, as far as I can see, so
> for all we know, it reports all those devices back "home"

[Whiskers]

So start 'etherape' or some other packet sniffer before running fing.

[Ken Springer]

On 2/18/16 9:45 PM, Anda Lucite wrote:
> Ken Springer wrote in message na5usc$agg$1...@news.albasani.net
>
>> Whiskers has the secret... "needs root".
>
> I don't know yet if Whiskers has the secret because "my" Android
> phone (which is NOT rooted!) can "see" all the devices on my network
> (9 of 16) where the other 7 of 16 used to be on the network in the past.
>
> So, Android can see *everything* without being root!
> https://i.imgur.com/Szjbr5f.gif
>
> How Android does that, I do not know.
>
> By way of contrast, if I *log* into my router as "admin" (essentially
> root), then I can see all the current devices, which are the same
> as what Android sees.
>
>> Unless things have changed, you will have to "root" your phone. That
>> simply means giving yourself "Administrator" rights. Never got abound
>> to doing it, since I could transfer from anywhere on the network to the
>> tablet.
>
> This is wrong.
> Fing will show you EVERYTHING on your network (past and present), without
> any need to be root!
>
> Try it to see what I mean and post a screenshot.
> Fing - Network Tools, by Overlook
> https://play.google.com/store/apps/details?id=com.overlook.android.fing
>
> HOW Android accomplishes what takes a router to be root is what I'm
> trying to do either on Windows or on Linux.

Obviously, my info is dated.

That being said, Fing isn't the answer for me. I'm not interested in
monitoring the network. I'm interested in file management across the
network. In my case, I'm using an Android tablet.


--
Ken
Mac OS X 10.8.5
Firefox 44.0
Thunderbird 38.0.1
"My brain is like lightning, a quick flash
and it's gone!"

[Jasen Betts]

On 2016-02-21, pedro <m...@privacy.net> wrote:
> On Sat, 20 Feb 2016 03:44:08 -0500, Paul <nos...@needed.com> wrote:
>
> (snip)
>>There would be "holes", as my
>>machines run more than one OS, and the assignment is
>>going to change (or even screw up) if I boot a different
>>OS.
>
> Why would the DHCP server see the machine's network interface
> differently after a reboot (whether into a different OS or not)?

DHCP requests nay include a hostname, and probably other details.

--
\_(ツ)_

[Anda Lucite]

Ken Springer wrote in message nag3bq$77e$1...@news.albasani.net

> That being said, Fing isn't the answer for me. I'm not interested in
> monitoring the network. I'm interested in file management across the
> network. In my case, I'm using an Android tablet.

A lot may depend on what you mean by file management.

For me, when I am on Windows or Linux and I want to access files on Android
or on iOS, what I do is start a freeware FTP server on Android or on iOS,
which then allows the File Explorer on Linux (Dolphin or Nautilus, for
example) and on Windows (Windows Explorer I think it's called) to see the
entire mobile device in the file explorer GUI.

[Ken Springer]

I prefer to have things networked, so I can open Windows Explorer,
Finder (OS X), or ?????? on the tablet, and just move/copy/store/ etc.
as I wish.

All I have to do is start the system, nothing extra.

[Anda Lucite]

Ken Springer wrote in message nahpa6$71o$1...@news.albasani.net

> I prefer to have things networked, so I can open Windows Explorer,
> Finder (OS X), or ?????? on the tablet, and just move/copy/store/ etc.
> as I wish.
>
> All I have to do is start the system, nothing extra.

If you have that working, it's better than what I have working, because
what I have working is that I have to manually start the FTP server on
the iOS or Android mobile device first - and only after doing that - then
I can access any file on Android and any "available" file on iOS from
either the Linus or Windows default graphical file explorer.

So how do *you* manage to do what I do, but automatically?
What software are you using on which platform?

[Ken Springer]

All my computers that I normally use are networked, so I can move files
among them as I please, using any of the computers. In the case of this
Mac, it's a PITA to get working, and I actually just mapped the drives I
wanted to use. I never have figured out how to open the Mac in Windows
Explorer, even though the Mac shows up under Network in Windows Explorer.

My tablet is a Nexus 7, Marshmallow 6.0.1 When everything was fully
working like I would like, I was running Kit Kat 4.4. But 5 and newer
broke my Bluetooth mouse. I've switched file management programs on the
tablet. When I was using ????????? on the tablet, I could move files
between the Mac and tablet no problem. But I found out that file
manager calls home, so I dumped it and installed X-Plore. It has never
been able to talk to the Mac, and I even reported it to the author. I
like this program because it uses a treeview, not just a list of items
that take some sleuthing to figure out where what is.

To get around that issue, I found a program called Android File Transfer
for the Mac. Worked great until Google broke it with an update.

My uses for the tablet have diminished to the point where the problems
created by updating don't really bother me, so I've not made any effort
into tracking down the problem.

But I had it backwards in my original post. I can't see the tablet on
the Windows computers, that's why the tablet needs to be rooted. But
every windows computer is there, and I can copy/move/etc. between tablet
and computer till the cows come home.

[Anda Lucite]

Ken Springer wrote in message nai30q$ous$1...@news.albasani.net

> But I had it backwards in my original post. I can't see the tablet on
> the Windows computers, that's why the tablet needs to be rooted. But
> every windows computer is there, and I can copy/move/etc. between tablet
> and computer till the cows come home.

If you run a freeware FTP program, on Windows or Linux you can easily explore
Android or iOS file systems using the normal Windows or Linux point-and-click
graphical file explorer.

There's nothing to it.

(I don't have a Mac so I can't tell you anything about the Mac.)

[Carlos E. R.]

On 2016-02-22 02:19, Anda Lucite wrote:

> If there was a better program than Fing on Linux/Windows for listing
> all devices, it's not known what it is.

nmap.

--
Cheers,
Carlos E.R.

[Anda Lucite]

Carlos E. R. wrote in message 0m76qc-...@minas-tirith.valinor

> nmap.

nmap sucks.
We already proved that.

[Carlos E. R.]

No, you did not.

"nmap -sn 192.168.1.*" tells what machines are up in my lan, and takes
two seconds to do it.

If you don't like how it prints the info, see the "OUTPUT" section on
the man to change the output.

something like "fping -a -c 1 -q -g 192.168.1.0/24" also does it, but
needs further adjustments to the options. For instance, replace -c with -C.

--
Cheers,
Carlos E.R.

[Anda Lucite]

Carlos E. R. wrote in message i0a8qc-...@minas-tirith.valinor

>> nmap sucks.
>> We already proved that.
>
> No, you did not.
>
> "nmap -sn 192.168.1.*" tells what machines are up in my lan, and takes
> two seconds to do it.

Unfortunately for both of us nmap gives incorrect (missing) information.
I just ran it again, using your suggested options and nmap found 5 devices
on my network while fing foud 9.

So nmap misses almost half the devices that I know are connected
(because I recognize all of them, mostly they are iPads).

> If you don't like how it prints the info, see the "OUTPUT" section on
> the man to change the output.

nmap is just bad.
It's worse than bad because people trust it.
But it gives incomplete answers.

> something like "fping -a -c 1 -q -g 192.168.1.0/24" also does it, but
> needs further adjustments to the options. For instance, replace -c with -C.

Fping is just as bad as nmap is missing the Apple devices on the network!

$ fping -a -c 1 -q -g 192.168.1.0/24
192.168.1.3 : duplicate for [0], 84 bytes, 27.0 ms
192.168.1.116 : duplicate for [0], 84 bytes, 23.7 ms
192.168.1.1 : xmt/rcv/%loss = 1/1/0%, min/avg/max = 2.01/2.01/2.01
192.168.1.2 : xmt/rcv/%loss = 1/1/0%, min/avg/max = 186/186/186
192.168.1.3 : xmt/rcv/%loss = 1/1/0%, min/avg/max = 26.7/26.7/26.7
192.168.1.4 : xmt/rcv/%loss = 1/0/100%
192.168.1.5 : xmt/rcv/%loss = 1/1/0%, min/avg/max = 0.08/0.08/0.08
192.168.1.6 : xmt/rcv/%loss = 1/0/100%
192.168.1.7 : xmt/rcv/%loss = 1/0/100%
192.168.1.8 : xmt/rcv/%loss = 1/1/0%, min/avg/max = 331/331/331
192.168.1.9 : xmt/rcv/%loss = 1/0/100%

In the situation above, Fing found that my Apple devices were on
192.168.1.6 & 192.168.1.7 which both nmap & fping totally missed.

So far, the *only* accurate output was from the command-line fing
on Linux (or on the iPhone or iPad).

[Carlos E.R.]

On 2016-02-28 09:39, Anda Lucite wrote:
> Carlos E. R. wrote in message i0a8qc-...@minas-tirith.valinor

>> "nmap -sn 192.168.1.*" tells what machines are up in my lan, and takes
>> two seconds to do it.
>
> Unfortunately for both of us nmap gives incorrect (missing) information.
> I just ran it again, using your suggested options and nmap found 5 devices
> on my network while fing foud 9.

It finds all devices in my network, but I don't have ipads.

If it doesn't find a particular device, it is because it doesn't respond
to that particular type of probe. So read the manual and find what you
have to change in the options so that it finds those devices.

> nmap is just bad.
> It's worse than bad because people trust it.
> But it gives incomplete answers.

No, it gives you the answer you ask of it, not what you think you are
asking.

>> something like "fping -a -c 1 -q -g 192.168.1.0/24" also does it, but
>> needs further adjustments to the options. For instance, replace -c with -C.
>
> Fping is just as bad as nmap is missing the Apple devices on the network!

Same reason as for nmap.

> In the situation above, Fing found that my Apple devices were on
> 192.168.1.6 & 192.168.1.7 which both nmap & fping totally missed.

So, do a full nmap scan on those IP to find where they do respond, what
ports they have open, then modify the scan command accordingly. I can't
do it because I don't have any apple hardware.

Perhaps:

nmap -A -T4 192.168.1.6

From what I read in a quick google search, apple devices keep silent. I
find these suggestions:

nmap -O -v ip

Also try adding --osscan-guess; --fuzzy for best results. Example:

nmap -O -v --osscan-guess ip

(http://stackoverflow.com/questions/16473379/trying-to-discover-ios-devices-on-my-network-using-python-script)

The last comment there gives a clue.



--
Cheers, Carlos.

[Anda Lucite]

Carlos E.R. wrote in message 35bbqc-...@Telcontar.valinor

> No, it gives you the answer you ask of it, not what you think you are
> asking.
>
>
>>> something like "fping -a -c 1 -q -g 192.168.1.0/24" also does it, but
>>> needs further adjustments to the options. For instance, replace -c with -C.
>>
>> Fping is just as bad as nmap is missing the Apple devices on the network!
>
> Same reason as for nmap.
>
>
>> In the situation above, Fing found that my Apple devices were on
>> 192.168.1.6 & 192.168.1.7 which both nmap & fping totally missed.
>
> So, do a full nmap scan on those IP to find where they do respond, what
> ports they have open, then modify the scan command accordingly. I can't
> do it because I don't have any apple hardware.
>
> Perhaps:
>
> nmap -A -T4 192.168.1.6
>
> From what I read in a quick google search, apple devices keep silent. I
> find these suggestions:
>
> nmap -O -v ip
>
> Also try adding --osscan-guess; --fuzzy for best results. Example:
>
> nmap -O -v --osscan-guess ip
>
> (http://stackoverflow.com/questions/16473379/trying-to-discover-ios-devices-on-my-network-using-python-script)
>
> The last comment there gives a clue.

I tried them all to no avail.
It's pretty simple to me.

Neither nmap nor fping nor arp-scan can hold a candle to fing
when it comes to the simplest of tasks, such as telling you all
the devices on your network.

To get fing to try it yourself:

$ wget "https://www.fingbox.com/download?plat=lx64&ext=deb"

$ mv "download?plat=lx64&ext=deb" fing_lx64.deb
$ sudo dpkg -i ./fing_lx64.deb

[William Unruh]

It would be much nicer if fing was opensource, so you could actually see
what it does scan for.


>

[Carlos E. R.]

On 2016-02-28 22:35, Anda Lucite wrote:
> Carlos E.R. wrote in message 35bbqc-...@Telcontar.valinor

> Neither nmap nor fping nor arp-scan can hold a candle to fing
> when it comes to the simplest of tasks, such as telling you all
> the devices on your network.

No, that is not true. Remember it is free software, you have to invest
your own work.

>
> To get fing to try it yourself:

No. First, it is proprietary, Secondly, I don't have apple hardware in
my premisses in order to test what it does differently.

--
Cheers,
Carlos E.R.

[John Hasler]

Carlos E.R. writes:
> Neither nmap nor fping nor arp-scan can hold a candle to fing when it
> comes to the simplest of tasks, such as telling you all the devices on
> your network.

No, telling *you* all the devices (that you know of) on *your* network.
Why should I believe that it will do likewise for me? It's closed
source so I can't find out what it really does.
--
John Hasler
jha...@newsguy.com
Dancing Horse Hill
Elmwood, WI USA

[Carlos E. R.]

On 2016-02-29 00:28, John Hasler wrote:
> Carlos E.R. writes:
>> Neither nmap nor fping nor arp-scan can hold a candle to fing when it

> No, telling *you* all the devices (that you know of) on *your* network.

Hey, I did not write that. Please quote correctly and attribute what was
said to the appropriate person.

--
Cheers,
Carlos E.R.

[Anda Lucite]

John Hasler wrote in message 87twksq...@thumper.dhh.gt.org

> No, telling *you* all the devices (that you know of) on *your* network.
> Why should I believe that it will do likewise for me? It's closed
> source so I can't find out what it really does.

I understand that you like open source software,and so do I.
I also understand that you don't have Apple equipment on your network
(or so you think).

I have nothing against nmap or arp_scan or fping (other than they don't
work to list *all* the devices on the network).

But, how do you know, if you don't use fing, that you don't have a rougue
Apple device on your network?

Of course, you can tell by looking at your router.
Or by running fing on your Android phone.

But, if you don't do that, how can you tell, using only the open-source
software, that you don't have a rouge Apple device on your network?

[Anda Lucite]

William Unruh wrote in message navpcl$ta0$1...@dont-email.me

> It would be much nicer if fing was opensource, so you could actually see
> what it does scan for.

I'm not gonna disagree with you nor with anyone who *wishes* that
arp_scan or fping or nmap would simply list all the devices on
the network.

I wish they would too.
But they don't.

Why?
I do not know.

The good news is that you can log into your router to see whether there is a
rogue Apple device on your network.

The bad news is that you can NOT see that rogue Apple device from Linux
without using fing (as far as anyone here can tell).

[Anda Lucite]

Carlos E. R. wrote in message bllcqc-...@minas-tirith.valinor

> Hey, I did not write that. Please quote correctly and attribute what was
> said to the appropriate person.

I appreciate the help from everyone!

We all tried nmap.
We all tried fping.
We all tried arp_scan.

None of them seem to report *all* the devices on the network.
That is bad. Very bad.

Luckily, both fing and logging into the router *does* report all the
devices on the network (we hope).

At least they reported *more* devices on the network than did the
typical linux tools.

It's sad that fing is needed.
But it's good that it exists.

[Carlos E.R.]

On 2016-03-02 05:23, Anda Lucite wrote:
> The bad news is that you can NOT see that rogue Apple device from Linux
> without using fing (as far as anyone here can tell).

No, that is not true. You have to find out how. And it is you who has to
investigate how to do it for us, not the other way round, as it is you
who has Apple hardware >:-)

Linux expects its users to contribute back ;-)

--
Cheers, Carlos.

--- news://freenews.netfront.net/ - complaints: ne...@netfront.net ---

[Carlos E.R.]

On 2016-03-02 05:21, Anda Lucite wrote:

> But, how do you know, if you don't use fing, that you don't have a rougue
> Apple device on your network?

Because I control my router.

[Chris Ahlstrom]

Anda Lucite wrote this copyrighted missive and expects royalties:

http://www.computerworld.com/article/2472460/networking/fing-is-a-great-app-to-see-who-is-on-your-network.html

be very wary using this app - my son just clocked up $1900 on this app -
do not use it

--
You are a fluke of the universe; you have no right to be here.

[Anda Lucite]

Carlos E.R. wrote in message bkpiqc-...@Telcontar.valinor

>> But, how do you know, if you don't use fing, that you don't have a rougue
>> Apple device on your network?
>
> Because I control my router.

I agree you know that.
But you don't know that because you control your computer.

Without fing, you can't know that "from" your computer.

I find it hard to believe that there is no way, without installing fing,
that we can know this - but that's the net of this thread unfortunately.

[Anda Lucite]

Carlos E.R. wrote in message pppiqc-...@Telcontar.valinor

> No, that is not true. You have to find out how. And it is you who has to
> investigate how to do it for us, not the other way round, as it is you
> who has Apple hardware >
>

> Linux expects its users to contribute back ;-)

I *did* contribute back.

1. I asked how to list all devices from the computer.
2. The answer was to try nmap, fping, arp_cache, & fing.
3. I reported back to the team results of testing all four suggested solutions.

What more do you want me to do to "contribute back"?

[Anda Lucite]

Chris Ahlstrom wrote in message nb6g8i$drn$1...@dont-email.me

> http://www.computerworld.com/article/2472460/networking/fing-is-a-great-app-to-see-who-is-on-your-network.html
>
> be very wary using this app - my son just clocked up $1900 on this app -
> do not use it

Reading
Computerworld | Feb 27, 2012 8:30 PM PT, Defensive Computing:
http://www.computerworld.com/article/2472460/networking/fing-is-a-great-app-to-see-who-is-on-your-network.html

1. "I have been looking for a simple way to see all the devices on a Local Area Network for a long time."
2. "Fing...seems to be the answer. It's fast, free and extremely useful."
3. "Unlike my router, Fing reports on all connected devices"
4. "The main feature is scanning and discovering all devices on the network..."
5. The author found differences in *what* was reported between Android & iOS (but not what devices)
6. "Apple nonetheless appears as the manufacturer of record"
7. "Fing keeps track of all the devices that it has ever seen on the network"
8. "not only is Fing free, but there are no ads"

Given the ending quote, how can someone rack up a single dollar using fing?

[John Hasler]

Anda Lucite writes:
> Given the ending quote, how can someone rack up a single dollar using
> fing?

Probably by trying to scan the entire Internet from his smartphone and
so chewing through his dataplan quota.

[William Unruh]

On 2016-03-02, Carlos E.R. <robin_...@invalid.es> wrote:
> On 2016-03-02 05:23, Anda Lucite wrote:
>> The bad news is that you can NOT see that rogue Apple device from Linux
>> without using fing (as far as anyone here can tell).
>
> No, that is not true. You have to find out how. And it is you who has to
> investigate how to do it for us, not the other way round, as it is you
> who has Apple hardware >:-)

It is always a bad idea to reinvent the wheel. Ie, if something he needs
already exists, he should use it. It seems it does not in the open
community. He could not know that without asking.

Now, how can he proceed?
a) use fing, a closed source program which might be infected and be
reporting home on a variety of things.

b) run tcpdump, or some other network sniffer and see what packets are
sent out by fing to the other machines, which differ from what
fping/nmap/... send out.

>
> Linux expects its users to contribute back ;-)

No it does not expect it. It does encourage it, but that is vastly
different and there is no necessity to do so in order to use linux.

>

[William Unruh]

Sorry, how did he manage to clock up any money using this app? I thought
it was free. Where was the charge?

>

[Richard Kettlewell]

William Unruh <un...@invalid.ca> writes:
> Carlos E.R. <robin_...@invalid.es> wrote:
>> On 2016-03-02 05:23, Anda Lucite wrote:
>>> The bad news is that you can NOT see that rogue Apple device from Linux
>>> without using fing (as far as anyone here can tell).
>>
>> No, that is not true. You have to find out how. And it is you who has to
>> investigate how to do it for us, not the other way round, as it is you
>> who has Apple hardware >:-)
>
> It is always a bad idea to reinvent the wheel.

Disagree, sometimes reinveinting a metaphorical wheel is necessary to
get past limitations of the existing one. Linux is a good example.

--
http://www.greenend.org.uk/rjk/

[HASM]

> I find it hard to believe that there is no way, without installing fing,
> that we can know this - but that's the net of this thread unfortunately.

I didn't know what fing was until I bumped into this thread...

I bet one could start wireshark, send a couple of broadcast messages,
though not sure which ones, and get replies from most boxes on the
subnet allowing them to be listed.

You probably get better answers in a network group.

-- HASM

[Zaidy036]

On 2/18/2016 12:42 AM, Anda Lucite wrote:
> How does my Android phone figure out what's on my network
> without logging into the home router?
>
> I can see 8 devices on the network when I log into the admin account
> of the router using a web browser on a laptop.
>
> However, I can see all those devices from my Android phone WITHOUT
> logging into the router, simply by using "Fing" Android freeware:
> https://i.imgur.com/Szjbr5f.gif
>
> My question?
>
> How does the phone see both wired & wireless devices (such as a
> wired printer & a wired Ooma) without logging into the router?
>
> More importantly, how can I get Windows & Linux to see the
> same 8 or 9 devices on my network that the phone sees *without*
> logging into the router's admin account?
>
look at the free Nirsoft utilities Network Monitoring Tools
< http://launcher.nirsoft.net/ >

[Carlos E.R.]

I suggested other options on nmap to try. See what, if anything, is
responding to network on those machines.

--
Cheers, Carlos.

[Carlos E.R.]

I'm sure there are other ways, but first we have to find out how to
detect an ipad that has a known address.

I suggested something like:

nmap -A -T4 192.168.1.6

if the ipad is known to be on that address.

What ports does it have open, if any?
Any service to connect to?
Nothing?

If nothing, then the trick instead is passively listening on the network
for packages coming from any device and log them. Ntop does that, precisely.

--
Cheers, Carlos.

[Jasen Betts]

If you know the IP address of the apple device does "arping" on that
IP get a response from it (I'm asking because I can't test that here)

--
\_(ツ)_