What’s on your Linux network?

If you’d like to know what systems and devices are attached to your local network—whether out of security concerns or simple curiosity, Linux has some really great commands for providing answers. In this post, we’ll probe a small network and see how devices can be identified.

nmap

The first tool we’ll use is nmap, which stands for Network Mapper, an open source tool for exploring networks and doing some serious security auditing. It was designed to work quickly even on large networks and provide information using raw packets to identify hosts, services, and sometimes even operating systems.

The simple scan shown below is detecting systems and devices on the local network. The “/24” portion of the target address indicates that all hosts in the 192.168.0.x IP address range are to be included.

$ nmap -sn 192.168.0.0/24
Starting Nmap 7.80 ( https://nmap.org ) at 2021-03-19 11:32 EDT
Nmap scan report for _gateway (192.168.0.1)
Host is up (0.0088s latency).
Nmap scan report for 192.168.0.5
Host is up (0.0083s latency).
Nmap scan report for 192.168.0.10
Host is up (0.018s latency).
Nmap scan report for dragonfly (192.168.0.11)
Host is up (0.00030s latency).
Nmap scan report for 192.168.0.14
Host is up (0.00039s latency).
Nmap scan report for 192.168.0.15
Host is up (0.098s latency).
Nmap scan report for 192.168.0.17
Host is up (0.047s latency).
Nmap scan report for 192.168.0.20
Host is up (0.11s latency).
Nmap scan report for 192.168.0.22
Host is up (0.0046s latency).
Nmap scan report for 192.168.0.23
Host is up (0.096s latency).
Nmap scan report for firefly (192.168.0.28)
Host is up (0.044s latency).
Nmap done: 256 IP addresses (11 hosts up) scanned in 11.78 seconds

Run the command with sudo,and you’ll also see the MAC addresses along with some vendor information:

$ sudo nmap -sn 192.168.0.0/24
Starting Nmap 7.80 ( https://nmap.org ) at 2021-03-22 08:36 EDT
Nmap scan report for router (192.168.0.1)
Host is up (0.034s latency).
MAC Address: F8:8E:85:35:7F:B9 (Comtrend)
Nmap scan report for 192.168.0.2
Host is up (0.11s latency).
MAC Address: 20:EA:16:01:55:EB (Unknown)
Nmap scan report for 192.168.0.5
Host is up (0.10s latency).
MAC Address: 02:0F:B5:5B:D9:66 (Unknown)
Nmap scan report for 192.168.0.8
Host is up (0.12s latency).
MAC Address: 86:89:DC:1B:9E:B4 (Unknown)
Nmap scan report for 192.168.0.10
Host is up (0.12s latency).
MAC Address: 3C:28:6D:D5:9C:89 (Google)
Nmap scan report for 192.168.0.12
Host is up (0.11s latency).
MAC Address: 44:65:0D:43:ED:44 (Amazon Technologies)
Nmap scan report for 192.168.0.14
Host is up (0.00025s latency).
MAC Address: 9C:3D:CF:E7:F3:71 (Netgear)
Nmap scan report for 192.168.0.17
Host is up (0.11s latency).
MAC Address: AC:63:BE:CA:10:CF (Amazon Technologies)
Nmap scan report for 192.168.0.18
Host is up (0.11s latency).
MAC Address: 04:ED:33:7C:44:C6 (Unknown)
Nmap scan report for 192.168.0.20
Host is up (0.080s latency).
MAC Address: 02:0F:B5:0D:17:27 (Unknown)
Nmap scan report for 192.168.0.22
Host is up (0.0053s latency).
MAC Address: 00:25:B3:F4:74:68 (Hewlett Packard)
Nmap scan report for firefly (192.168.0.28)
Host is up (0.053s latency).
MAC Address: 7C:67:A2:CF:9F:EF (Intel Corporate)
Nmap scan report for dragonfly (192.168.0.11)
Host is up.
Nmap done: 256 IP addresses (13 hosts up) scanned in 11.58 seconds

Notice that host names are provided when they are available to the system.

The network being scanned is my home network. The list shown may seem to include a lot of devices for a home network, but I have a small heterogenous network (one Windows 10 system, two Linux systems and a MacBook Pro) all up and running. In addition, there are at least two other computers in the house, a few tablets, two printers and a scanner. In the scan above, the “-sn” argument string is telling nmap to discover hosts but not to perform port scans.