How to find the IP address of a router

Question

I live in a dorm where many students have setup small wireless networks. There are two of this networks that are very close to my room as the signal is very strong. Our college uses DHCP to assign IP addresses. I believe that these routers are on the college network along with my computer. I have the MAC addresses for the routers but how would I find the external IP address for the routers?

Answer 1

There is a way to find out if you modify the TTL values. You can do this using a tool such as hping, or simply traceroute (tracert in Windows).

I am connected to an access point, and I can do a traceroute to an outside IP address then see what the second "hop" is:

C:\>tracert google.com

Tracing route to google.com [173.194.41.131]
over a maximum of 30 hops:

  1     2 ms     2 ms     2 ms  10.21.176.2
  2     4 ms     3 ms     2 ms  10.21.161.150
  3     7 ms     4 ms     6 ms  ^C (<-- I pressed control c to stop it)
C:\>

Here you can see that 10.21.176.2 is my gateway (Access point) and you can then determine which of these IP addresses in the range of your second hop (in my case 10.21.161.*, assuming it's a normal C class network) will reply straight away, this can be either scripted or done manually:

C:\>tracert -d 10.21.161.149

Tracing route to 10.21.161.149 over a maximum of 30 hops

  1     3 ms     2 ms     3 ms  10.21.176.2
  2     2 ms     1 ms     1 ms  10.21.161.149

Trace complete.

We can keep on decreasing or increasing the last octet, again this is better if you'd script it (or run an hping with your ttl value set to 1):

C:\>tracert -d 10.21.161.142

Tracing route to 10.21.161.142 over a maximum of 30 hops

  1     2 ms     1 ms     3 ms  10.21.176.2
  2     2 ms     1 ms     1 ms  10.21.161.142

Trace complete.

C:\>tracert -d 10.21.161.141

Tracing route to 10.21.161.141 over a maximum of 30 hops

  1     1 ms    <1 ms    <1 ms  10.21.161.141

Trace complete.

Since 10.21.161.141 is only one hop away, and it's not on my network (I am on 10.21.176.0/24), it is the outside interface of my gateway. In my case, the access point.

Note: This won't work however if the access point blocks outgoing ICMP "TTL expired" messages, but normally they aren't configured that way.

Answer 2

Presumably what you've got is actually the BSSID of the router: this is router's "inside" MAC address. Unless you can connect to the WiFi network, there is no reliable way to get the router's external IP address. That said, many home routers have an external MAC address that is either one greater or one less than the BSSID. For example, if the BSSID is 68:05:E7:02:7B:66, the external MAC is probably either 68:05:E7:02:7B:67 or 68:05:E7:02:7B:65.

I assume you don't have access to DHCP logs, switch management consoles, or any other network infrastructure. In this situation, there's no easy way to turn a MAC address into an IP address: ARP only goes the other direction. Instead, you need to do ARP resolution of each IP address on the network until you find the one with the MAC address you're looking for. Linux provides tools such as "arp" and "arping" to do this; I presume Windows has similar tools.

Answer 3

DHCP is dynamic IP so every time you turned on the lap,it would be assigned with different IP and also noted that it would be connected to WiFi connection at a time so it would catches the strong signal near your room.You can use the following url

http://www.whatismyip.com/ip-address-lookup/

to find the external IP address that router is using to connect internet