how to detect that specified machine is present in local network

Question

how can i detect - using bash if possible - that specific (i.e. name or mac address) machine has appeared in local network? IP addresses are dynamically assigned, so I can't rely on "traditional" ping.

Answer 1

If you know the MAC address then you can ping it with arping

Answer 2

The easiest solution is to check the DHCP server's logs, if you have access to them.

Otherwise, you can use the traditional ping command to broadcast ping the local LAN and look in your system's local ARP table to see if your target host has replied. This does not require knowing the target's IP address, only its MAC. Example:

ping=`which ping`
iface=eth0 # MAYBE CHANGE THIS
bcast=`ip a ls $iface | awk '/inet? /{ print $4 ; exit }'`
cmd="$ping -bnrc1 $bcast"
target_mac='00:11:22:33:44:55' # DEFINITELY CHANGE THIS
if [[ -u $ping ]] ; then $cmd ; else sudo $cmd ; fi
grep $target_mac /proc/net/arp

This is similar to 'arping' in that it should trigger an ARP reply, only it's noisier. For this reason, add '-r' to limit it to the local LAN, use the directed broadcast address (that awk snippet grabs it, but you may need to adjust 'iface') instead of '255.255.255.255', and send only one ICMP echo request with '-c1'. Turn off reverse DNS resolution with '-n'.

'ping' will only honor the '-b' broadcast option if it is setuid root or you have root privileges, so I've wrapped it in an if/else to catch that.

Answer 3

You need to actively monitor traffic in order to do this. Look at arpalert or arpwatch. arping is also an option but it won't work in this case because it needs the target ip address.