How can I determine if a certain machine exists on the network?

If I ping the IP address, would that be sufficient?

YeJiabin

Posted 2011-09-27T04:05:06.490

Reputation: 161

The correct answer depends on precisely how much you know about the machine and precisely how you define "exists on the network". (For example, if the machine is connected to the network and listening to broadcasts but never, ever sends anything at all, does it "exist on the network"?) – David Schwartz – 2011-09-27T05:57:26.080

Answers

No - a machine is not obliged to respond to a ping. To be certain, you need to ping from the local network the machine is on, then check for an arp response:

arp -a

If you see a mac address against the IP address, then the device exists. If not, then it is effectively not present (right now - it could just be powered off for the moment).

Paul

Posted 2011-09-27T04:05:06.490

Reputation: 52 173

it is possible for a computer to ignore arp requests, it depends on how much a computer wants to hide. – bryan – 2011-09-27T04:52:03.930

1@bryan Certainly - but if it ignores arp requests it is effectively not present, in that you could add another machine to the same network with the same IP and not get a conflict (unless it responds to some arp requests, but that is an edge case that can probably be be excluded from this scenario) – Paul – 2011-09-27T06:12:34.703

Hmm. Unaccepted - did this not work for you @YeJiabin? – Paul – 2011-10-05T23:43:20.040

Pinging is not enough. Many firewalls will block pings.

You could try nmap

nmap -PN 192.168.1.0

That attempts to discover host even if they are blocking ping scans.

bryan

Posted 2011-09-27T04:05:06.490

Reputation: 7 848

@Paul not sure if you are right, but at my company's intranet nmap -PN shows the host while simply pinging and checking the arp table show nothing. – Pithikos – 2014-08-20T14:45:53.183

@Pithikos Interesting - ping + arp works here. If nmap was able to detect it, then the device must be responding to arp requests, so the question is why this response wasn't stored in the arp cache. – Paul – 2014-08-21T02:20:55.320

1Is there any better solutions? Thanks anyway. – YeJiabin – 2011-09-27T04:17:21.087

1I am not sure why this answer was promoted. nmap -Pn in absense of any open ports will confirm the presence of a host by ARP response. It is the same as pinging it and checking your arp table, but without the need to install nmap. – Paul – 2011-09-27T06:18:32.963