7

I am trying to see the IPs of all the devices connected to my WIFI. Everyone suggests to use the command arp -a in the terminal but when I do so I get always the same list of devices. I try to connect new ones but they do not show up. However if I connect to the router administration site (192.168.1.1) in the browser, I can see all the devices I am looking for.

How can I get all devices in the terminal using arp -a? Is there an alternative to get the complete list?

2 Answers 2

11

ARP is the Address Resolution Protocol.

TCP/IP stacks use ARP to map between an IP address (like 10.0.1.1) and hardware (usually MAC) address, like 00:11:22:AA:BB:CC. Because there's overhead in performing mapping, computers maintain a cache of recently mapped addresses. The command arp -a displays the cache. Sometimes the cache may also contain mappings for computers which have announced their address or otherwise contacted your computer. Cache entries will expire after a certain length of time, so if your computer hasn't contacted another one in a while you won't see that other one in the cache.

There's no reason to expect that this cache would contain the IP addresses of every computer on your network. That's not what it does, and no one should be suggesting that it will contain the IP address of every computer on your network. That's simply incorrect.

You can try iterating over all the IP addresses on your network and pinging each one. That will force your computer to attempt to use ARP to map the IP address to the hardware address for each computer. You can also try pinging the broadcast address of the network (ping 192.168.1.255 in this case).

After completion, arp -a will provide a more thorough (but still possibly incomplete) list of computers on your network. Note that pinging the broadcast address may cause a lot of traffic on your network and may not be welcome on other people's networks. Also, some computers may choose not to respond.

If you want to scan the network, a better tool to use is a network scanner, like nmap. In this case, you might try running nmap -sn '192.168.1.*'.

Beware that nmap will also happily scan ports to discover running services, depending on the options you give it. It can be quite slow. It can also trigger security monitors. Some organizations will consider nmap scanning to be a hostile action.

Note that you will likely have to install nmap on your computer to use it.

Also, hosts may hide from nmap's scan, so it will not necessarily provide a complete list of all computers on your network.

Ultimately you already answered your own question. Only your router (and wifi access point, if it's separate) knows all the computers that are on your network, and ultimately only it can provide a reliable list.

If it supports it, you can try using SNMP, the Simple Network Management Protocol, which is designed to talk to and manage routers, among other devices. SNMP can report a routers DHCP lease list, which is the definitive list of IP addresses that the router has assigned to computers on the network (note however that computers which have been configured to use a static IP address may not show up here). It can also access the router's ARP cache. And depending on the wifi access point, it may be able to return the list of devices that the access point knows is connected. Between these you can piece together a comprehensive list of computers on the network.

To do this you'll need to install SNMP manager software on your computer. How you do this and how you use it to talk to your router or access point are highly dependent on your setup; if you need help with this, try to figure it out and post new questions about.

3
  • Excellent point about nmap tripping warnings - every time I run it at work, I get a security protocol violation notification and have to explain why it was necessary.
    – Criggie
    Aug 22, 2021 at 9:58
  • "You can try iterating over all the IP addresses on your network and pinging each one. That will force your computer to attempt to use ARP to map the IP address to the hardware address for each computer." -- I just had a look at Wireshark and, indeed, ICMP packets end up getting wrapped in ethernet frames with destination MAC set to the target machine's MAC, if the target machine is in the LAN and its MAC is known. If the target machine is not in the LAN (and its MAC not known), the ethernet frames will specify the router's MAC as destination. Could you explain why this is the case?
    – balu
    Sep 9, 2022 at 16:12
  • (continued) Or put differently, why will pings cause ARP scans in the first place? I mean, ICMP packets require an IP address as destination, nothing more. Shouldn't it be possible for the network stack on localhost to always wrap the ICMP packet in an Ethernet frame with destination MAC set to the router's MAC and pass it on the router? Why does it need/try to obtain the target machine's MAC?
    – balu
    Sep 9, 2022 at 16:13
2

It can, but there's a ~5 minute timeout on unused records in the ARP table. So entries will timeout.

You can probably extend that timeout, but a quicker answer is just to sweep through the IP network first.

fping -a -g 192.168.1.0/24  ;  arp -an | grep -v incomplete

Grepping out the incomplete records removes the ones where no host was found, and -n saves waiting for a bunch of reverse DNS lookups that won't work anyway.

I like fping but there are other options like arping or nmap or scripting the use of ping.

Not the answer you're looking for? Browse other questions tagged or ask your own question.