Find local network devices using ping

Here in the Oregon HQ for macosxhints.com, we’ve got a few devices on our local network. There are the Macs, of course, and a networked Brother laser printer, the AirPort Base Station, and our (rarely used any longer, thanks to Parallels Desktop and Boot Camp ) aging PC. Then there are the random things that come and go, such as the occasional machine from my wife’s office, or products for review, such as the Axis 207W wireless camera.

When I set the network up, I decided that I wanted to use static IP addresses for all the devices that are usually here, and then have dynamic IP addresses assigned to temporary devices. This has worked well for me, as I’ve memorized the IP addresses for our machines and printer.

But sometimes I run into a problem when there’s a device that I haven’t used in a while, such as the Axis camera. It had been unplugged for a few weeks when I recently wanted to use it again. So I plugged it in, only to realize that I had no idea what its IP address was. Without the IP address, I couldn’t view the camera’s images nor change its settings. (Other than that, it was perfectly useful!) Short of resetting it to the factory defaults, I thought there must be a way to find its address on my network.

After some digging, I found that the Unix command ping offers a solution. Usually, ping is used to send an “echo request” packet to a given host or IP address. If the device is capable of replying (and hasn’t had that ability blocked), then the device will respond with an echo response. You can see this for yourself in Terminal by typing this command:

ping www.apple.com

You’ll see a something like this when you run the command:

	PING www.apple.com.akadns.net (17.254.0.91): 56 data bytes	64 bytes from 17.254.0.91: icmp_seq=0 ttl=238 time=29.237 ms	64 bytes from 17.254.0.91: icmp_seq=1 ttl=238 time=29.215 ms	64 bytes from 17.254.0.91: icmp_seq=2 ttl=238 time=29.207 ms	...	

This will repeat until you tell it to stop by pressing Control-C. (Note that many websites will block ping requests, so you may not get any response at all.) You can do the same thing on your local network, assuming you know the device’s IP address. On our network, for instance, our printer’s IP address is 192.168.1.101, and if I ping 192.168.1.101, I’ll see the same sort of output. But how can ping help if you don’t know the device’s address?

Some versions of ping support a “broadcast” option, which will send a ping to every possible address on the network, and then list those devices that respond. Unfortunately, the version of ping included with OS X does not include that option. It does, however, have another way to do a broadcast ping: just send a normal ping to a special IP address on your network.

In order to do this, you need to know two things—your network’s IP address setup and the subnet mask value. Both of these values are easily seen in the Network control panel, in the IP Address and Subnet Mask fields, respectively. In my case, my Mac’s IP address is 192.168.1.77, so the network is using a 192.168.1.xxx sequence, and the subnet mask is 255.255.255.0. The special ping address can be figured out by taking any zero values from the subnet mask, changing them to 255, and then putting them into the same relative position in the IP address field. In my case, the last digit of my subnet mask is zero, so I change that to 255, and put it into the last position of my IP address, then ping that address:

ping 192.168.1.255

If my subnet mask were 255.255.0.0, then the ping address would be 192.168.255.255. When I ping this special 255 address, I get a response from every device on the network that can respond to ping requests:

	$ ping 192.168.1.255	PING 192.168.1.255 (192.168.1.255): 56 data bytes	64 bytes from 192.168.1.77: icmp_seq=0 ttl=64 time=0.132 ms	64 bytes from 192.168.1.23: icmp_seq=0 ttl=64 time=0.287 ms (DUP!)	64 bytes from 192.168.1.62: icmp_seq=0 ttl=64 time=0.589 ms (DUP!)	64 bytes from 192.168.1.101: icmp_seq=0 ttl=60 time=1.055 ms (DUP!)	64 bytes from 192.168.1.57: icmp_seq=0 ttl=64 time=148.118 ms (DUP!)	64 bytes from 192.168.1.77: icmp_seq=1 ttl=64 time=0.100 ms	64 bytes from 192.168.1.23: icmp_seq=1 ttl=64 time=0.281 ms (DUP!)	...	

Again, this will repeat until you press Control-C. Since I know the addresses of my Macs and the printer, I was able to see that the 192.168.1.57 address wasn’t usually there. Hence, that was the camera’s IP address.

But what if that’s not enough? What if you’ve got a lot of devices, and you can’t really be sure which is which? After running the broadcast ping, you can then run the arp (which is short for Address Resolution Protocol ) command. If you use arp with the -a option, it will show everything that it knows about. In my case, it looks like this:

	$ arp -a	? (192.168.1.1) at 0:f:c3:d6:6d:15 on en0 [ethernet]	? (192.168.1.23) at 0:26:cd:c7:d5:db on en0 [ethernet]	? (192.168.1.77) at 0:3:63:f7:19:b5 on en0 [ethernet]	? (192.168.1.101) at 0:80:57:33:9:11 on en0 [ethernet]	? (192.168.1.255) at (incomplete) on en0 [ethernet]	

The machine I’m running the command from ( 192.168.1.77 ) doesn’t show in the list, but everything else does—including the MAC address, which is the series of numbers and letters separated by spaces. The MAC address uniquely identifies each piece of hardware, and can usually be found somewhere on the device itself. In OS X, for instance, it’s on the Ethernet tab of the Networking control panel (if you’re on a wired network). Hardware devices, such as cameras, might have the MAC address on a visible label. With the MAC address in hand, you should be able to find every device on your local network.

A few of notes. First, if you’re in an office, particularly a large office, I would not recommend using this command—you may suffer the wrath of the system admin if you poll every device on a 500 unit network! Second, if you’re on an AirPort network and you haven’t reconfigured anything, the default IP addressing scheme is 10.0.1.xxx, so the special broadcast ping address would be 10.0.1.255. Finally, I’ve modified all the IP and MAC addresses in this article, in the interest of obscuring the real addresses of my machines (though they all live behind a firewall, obviously).

Happy device searching!