thanks
Not reliably, No. For one thing, some devices are more than one
of those simultaneously.
Methods for detecting this kind of information aren't perfect, but it is
possible to learn quite a bit from things like port scanning, etc.
Unfortunately, information on how to do this is hard to come by, and
things like firewalls tend to block access to this kind of data.
There is a product for home networks that does this; it's located at
http://www.networkmagic.com .
Disclaimer: I used to work for this company.
> is there a way to determine that a device at a given IP address is a
> computer, as opposed to a printer/router/switch, etc; using TCP?
A printer/router/switch usually *is* a computer, it just has extra
hardware to support its dedicated functions, and it runs software to
provide those functions.
So maybe you need to define your terms better. Perhaps what you want to
know is whether it's a PC running Windows.
--
Barry Margolin, bar...@alum.mit.edu
Arlington, MA
*** PLEASE post questions in newsgroups, not directly to me ***
*** PLEASE don't copy me on replies, I'll read them in the group ***
Yes! Arp will help you find the MAC address related to the IP address and go
from there.
The Dude
>"Java and Swing" <code...@gmail.com> wrote in message
>news:1153339704.4...@s13g2000cwa.googlegroups.com...
>> is there a way to determine that a device at a given IP address is a
>> computer, as opposed to a printer/router/switch, etc; using TCP?
>Yes! Arp will help you find the MAC address related to the IP address and go
>from there.
And how does that help? For example if you find that the MAC address
is one allocated to HP, then does that tell you whether you are
using an HP printer, HP switch, or HP PC? If the MAC address is one
allocated to 3Com, does that tell you whether the device is a PC
running Windows, or a PC running uLinux that has been specialized
to be a router?
> In article <UoAvg.215110$IK3.203657@pd7tw1no>,
> The Dude <The Du...@thedu.de> wrote:
>
>>"Java and Swing" <code...@gmail.com> wrote in message
>>news:1153339704.4...@s13g2000cwa.googlegroups.com...
>>> is there a way to determine that a device at a given IP address is a
>>> computer, as opposed to a printer/router/switch, etc; using TCP?
>
>>Yes! Arp will help you find the MAC address related to the IP address and
>>go from there.
>
> And how does that help? For example if you find that the MAC address
> is one allocated to HP, then does that tell you whether you are
> using an HP printer, HP switch, or HP PC?
Or an IBM PC with an HP NIC?
> If the MAC address is one
> allocated to 3Com, does that tell you whether the device is a PC
> running Windows, or a PC running uLinux that has been specialized
> to be a router?
--
--John
to email, dial "usenet" and validate
(was jclarke at eye bee em dot net)
> is there a way to determine that a device at a given IP address is a
> computer, as opposed to a printer/router/switch, etc; using TCP?
Well, now, some Cisco routers are not much different from PCs--Intel
processor, PCI bus, the whole nine yards.
All you can really tell is what ports respond. That won't tell you if you
are dealing with a purpose-made router or a PC configured to perform the
equivalent functions though.
J. Clarke a écrit :
> Java and Swing wrote:
>
>>is there a way to determine that a device at a given IP address is a
>>computer, as opposed to a printer/router/switch, etc; using TCP?
>
> Well, now, some Cisco routers are not much different from PCs--Intel
> processor, PCI bus, the whole nine yards.
But I guess that these Cisco devices still run some form of IOS. So OS
fingerprinting with tools such as nmap may be able to tell the difference.
any suggestions? are there certain ports that I could look for
perhaps, or a good way to determine the OS?
Also, for Networkmagic ....how does it perform its network map?
Check the vendor's website to tell the difference... They have specific
ranges for specific devices.
The Dude
>any suggestions?
You haven't given us information about the restrictions you are
working under. Are we to assume that the prober is on the same
ethernet segment? In the same broadcast domain? In the same IP
address range? On the same side of any router? Possibly reached
through one or more routers? Are there any manner of security
filters anywhere inbetween, including at the target device?
It uses a combination of methods, including ARP, DHCP, fingerprinting,
uPnP, etc. One place to ask about this is on the blog run by the
Network Magic folks: http://www.networkgarage.com
There is nothing in the stated requirements that suggests theres only
one segment.
--
-- Rod --
rodd(at)polylogics(dot)com
I'd start with http://www.insecure.org/nmap/
Interesting, learn something every day. When I get time I'm going to have
to play with that.