Use ARP to probe your LAN
ARP - Address Resolution Protocol - is part of "layer 2" of the Ethernet protocol - also known as the data link layer - and it is the mechanism by which Ethernet IP addresses are translated to MAC addresses.
ARP packets are sent regularly by every Ethernet network interface card that is connected to a network to either refresh it's IP to MAC address mapping or to discover a mapping that is currently not in the local ARP lookup table.
The ARP protocol message translated to english is basically:
"who has IP address Y.Y.Y.Y, tell Z.Z.Z.Z"
with Z.Z.Z.Z equal to the IP address the ARP message was sent from
The response is in the form:
"Y.Y.Y.Y is mm:mm:mm:mm:mm:mm"
with mm:mm:mm:mm:mm:mm being the MAC address associated with IP Address Y.Y.Y.Y
There are a few things about ARP that will help you find any active local network cards and the IP address(es) associated with it:
- ARP requests have to be enabled by an interface that is serving as a
router - without it (or without a static ARP route) you couldn't talk to it at all. A router serving as a DHCP server will respond to ARP requests (I'm sure there are exceptions, but not in a consumer product).
- ARP packets are not routable - they will not go off your local network segment, so you won't see hundreds or thousands of IP addresses that you would see in something like a DNS cache.
- You can see IP addresses that aren't on your IP subnet if they are active on the local LAN segment
e.g. you can't ping something on your local LAN segment if it is outside your configured subnet range unless a route is configured for it. ARP doesn't have knowledge of your subnet mask and will record all ARP records that sees.
How to clear, update and output the local ARP entries
Disconnect as many devices from your LAN as you can, including devices connected via wifi to the LAN - it will make interpreting the results much easier.
Open an elevated (admin) dos prompt, and enter the following commands.
The first one will flush out the arp cache.
arp -d *
The second command will send out a broadcast ping - which you will probably not see a response from, but it will update your arp cache. Just wait for it to time out. Note that this will get translated into a broadcast arp ping; so it is not limited by your subnet settings.
ping 10.255.255.255
Now output the cached ARP table
arp -a
You will get results listed by interface; I've shown an excerpt from the command being run on my local machine. The majority of your attention should be on the results from your physical network interface (you may have listings for virtual interfaces if you have VMWare or similar installed). I obfuscated the MAC (physical addresses) from this output.
Interface: 192.168.1.101 --- 0x5
Internet Address Physical Address Type
192.168.1.1 XX-XX-XX-XX-1b-c9 dynamic
192.168.1.2 XX-XX-XX-XX-16-d5 dynamic
192.168.1.103 XX-XX-XX-XX-17-53 dynamic
192.168.1.124 XX-XX-XX-XX-de-0c dynamic
192.168.1.255 ff-ff-ff-ff-ff-ff static
A few notes on the ARP table output:
Note that a single port of a network interface card can have multiple IP addresses - this may be going on with this device.
A single port can show as having multiple MAC addresses - usually this is because there are virtual adapters or bridges on the machine that are sharing the physical interface.
A given IP address should never be associated with multiple MAC addresses.
Everything* with an IP address on your local network should show up on this list. Try to identify each device.
Nearly all devices will send out an unsolicated ARP ping (which contains it's MAC address and associated IP address) shortly after a network connection is established. If you can't see it, and it isn't responding to the ping broadcast, you can try flushing your arp cache (arp -d *) with the router off, then turning it back on and view the arp cache output.
Other things to try if you can't get the IP address using this approach
- To get a low level view of everything on the network that your NIC can see you can use a tool called wireshark. If you can't get it's IP address any other way, using wireshark with your network card in promiscuous mode will almost certainly do it, but its non trivial to get started with the tool and understand what it is showing you.
- If all else fails, manually configure your network settings to the same IP address, default gateway and dns server settings assigned by the router, but change your subnet mask to increasingly larger sizes. 10.118.255.255 (/16), then 10.255.255.255 (/8) then 240.255.255.255 (/4), and use a tool like nmap to do an IP layer deep scan of that subnet while simultaneously running wireshark. The larger the subnet, the longer it will take, which is why I suggest stepping through increases.
*Disclaimer - this is assuming a typical home network without VLANs, no currently active VPN connections and no other currently active router or managed switch - all of these can make interpreting the ARP results more difficult and limit your visibility to ARP results for the local LAN.
try doing a
tracertto a website to see where the AP is? – td512 – 2016-05-27T09:37:41.810@td512 traceroute to a website i receive 30 hops. 1 * * * ..... 30 * * *. All values are stared. – Akash Kumar – 2016-05-27T11:20:44.183
What is your computers IP address when connecting to this? You could take a look at nmap or some other network scanner. – Mikael Kjær – 2016-05-29T10:17:58.413
Generally the router's address is the same as the gateway. The gateway can be found by looking at a computer's configuration on the network. On the command line that would be "ipconfig /A" on windows and "ifconfig" on linux. Sometimes the port is different - in that case you'll need to scan the router to find out the ports that are open using a network scanner. – le_top – 2016-05-29T10:20:00.420
@MikaelKjaer Ip address that i recieve is provided by ISP AP not by the ruckus router in my home. I think network scanner won't work because Router login ip is on different ip range and my ip i receive is on different range – Akash Kumar – 2016-05-29T11:00:09.273
@le_top I recieve default gateway of ISP AP not of the router i have in home and Ip of the router is also on different Ip range. – Akash Kumar – 2016-05-29T11:01:06.450
You need to manually assign your own IP address and scan the network, there is really no other way. That being said, I don’t know what you would gain by having access to the router. Because you are essentially directly connected to your IPS’ MAN, changing settings will have no effect whatsoever. Perhaps your actual goal would be a topic for a new question that could actually be answered. – Daniel B – 2016-05-29T11:16:57.753
@DanielB by gaining access i will flash official firmware of the product and use it as range extender or for other features. – Akash Kumar – 2016-05-29T11:34:17.470
Considering a basic OpenWrt-capable router is like $20, it’s not worth the effort. // Forgot to mention: When you do your IP scanning, the ISP can see it. – Daniel B – 2016-05-29T11:49:30.247
I did not see that you included the report before - did you check 10.118.128.1 . This is a private class A address, not a public address. – le_top – 2016-05-29T12:45:13.410
@le_top What report? – Akash Kumar – 2016-05-29T12:49:51.530
In the picture just below "this is how am connected" you have listed IP INFO. – le_top – 2016-05-29T12:51:16.507