0

Using Ubuntu, I attempted to list all devices connected to my wifi with

$ sudo nmap -sn 192.168.1.83/24     
Starting Nmap 7.80 ( https://nmap.org ) at 2021-08-19 10:35 CDT
Nmap scan report for amazon-6f0692a99.attlocal.net (192.168.1.66)
Host is up (0.069s latency).
MAC Address: 4C:17:44:23:23:B0 (Amazon Technologies)
Nmap scan report for 09AA01AC44161BRB.attlocal.net (192.168.1.99)
Host is up (0.31s latency).
MAC Address: 18:B4:30:87:D6:4E (Nest Labs)
Nmap scan report for dsldevice.attlocal.net (192.168.1.254)
Host is up (0.0031s latency).
MAC Address: 08:9B:B9:39:41:F2 (Unknown)
Nmap scan report for w-main-System-Product-Name.attlocal.net (192.168.1.83)
Host is up.
Nmap done: 256 IP addresses (4 hosts up) scanned in 23.16 seconds

Per the output above, there appears to be 5 devices with internal IP addresses currently connected. However, the browser-based GUI for the router correctly shows 8 additional devices connected that do not appear on the nmap output such as

enter image description here

Pinging 192.168.1.83 produced no results either even though there is definitely an active device connected with that IP.

Why is there a difference between nmap's output and the browser view of the router as well as pinging it?

1 Answer 1

0
  • Not every host will reply to a ping, so using nmap or another tool does not provide any guarantee that your sweep will yield complete results
  • for practical purposes, that means that when running a ping scan with nmap or another tool, some machines are stealth and not reported
  • even running a port scan against those machines may yield no result if they have no open port that can be probed by nmap
  • the conclusion is that you have to keep in mind the limitations of software tools, and that you may not see the whole picture
  • As you correctly assumed, the best is to look directly in the web interface of your router
  • but some of the hosts may be connected to an ethernet port and not wifi, thus they are not wifi clients but they are still connected to the same router through a different connection. And they may be DHCP clients too, or have a static IP address.
  • it's even possible that the ethernet ports on your wifi router use another range than 192.168.1.0/24...
  • The MAC address that begins with 80C5F2 is a device whose maker is AzureWave Technology Inc. if it helps
  • a tool like Airodump-ng would be more appropriate for your purpose: scanning the airwaves and listing the devices connected to your access point

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .