24

I connect my hotspot through ap-hotspot and I can see the notifications pop out displaying new device connected , device disconnected. (Because I want to learn about privileges for access to use or not use the hotspot.)

How can I list the device connected through terminal?

1

6 Answers 6

35

arp -a should return you a list of all connected devices.

3
  • 5
    also arp -an is useful --- to avoid long delays trying to resolve IP addresses.
    – Rmano
    Dec 27, 2014 at 11:38
  • arp does not update real time
    – Luis
    Jul 21, 2016 at 7:59
  • ip neigh show would be the modern approach Feb 17, 2023 at 19:06
11

Show a list of devices: (replace <interface> with the interface name of your wifi interface)

iw dev <interface> station dump

If you don't know the name of your wifi interface, use this command to find out the interface name:

iw dev
1
  • While this answer is good in its current state, it could still be improved. Perhaps you can add some example output or otherwise explain more as to what this command does?
    – Kaz Wolfe
    May 21, 2017 at 20:21
10

If you want a more detailed list, I adapted this script for the ap-hotspot script that comes from webupd8:

#!/bin/bash

# show_wifi_clients.sh
# Shows MAC, IP address and any hostname info for all connected wifi devices
# written for openwrt 12.09 Attitude Adjustment
# modified by [email protected] from http://wiki.openwrt.org/doc/faq/faq.wireless#how.to.get.a.list.of.connected.clients

echo    "# All connected wifi devices, with IP address,"
echo    "# hostname (if available), and MAC address."
printf  "# %-20s %-30s %-20s\n" "IP address" "lease name" "MAC address"
leasefile=/var/lib/misc/dnsmasq.leases
# list all wireless network interfaces 
# (for MAC80211 driver; see wiki article for alternative commands)
for interface in $(iw dev | grep Interface | cut -f 2 -s -d" ")
do
  # for each interface, get mac addresses of connected stations/clients
  maclist=$(iw dev "$interface" station dump | grep Station | cut -f 2 -s -d" ")
  # for each mac address in that list...
  for mac in $maclist
  do
    # If a DHCP lease has been given out by dnsmasq,
    # save it.
    ip="UNKN"
    host=""
    ip=$(cat $leasefile | cut -f 2,3,4 -s -d" " | grep "$mac" | cut -f 2 -s -d" ")
    host=$(cat $leasefile | cut -f 2,3,4 -s -d" " | grep "$mac" | cut -f 3 -s -d" ")
    # ... show the mac address:
    printf "  %-20s %-30s %-20s\n" "$ip" "$host" "$mac"
  done
done

Copy it to a file in your PATH, for example ~/bin/show_wifi_clients, make it executable with chmod +x, and enjoy.

3
  • A nice an crazy script, thanks for sharing, :)... Jan 24, 2017 at 20:15
  • 1
    the variables in printf " %-20s %-30s %-20s\n" $ip $host $mac" must be double quoted to print correctly. Edited the answer likewise...
    – Magguu
    Jun 2, 2019 at 9:10
  • @Magguu you're right, edit accepted.
    – Rmano
    Jun 2, 2019 at 10:42
0

This one also gets the mac vendors of the devices and can also label the mac of your devices. Requires Python3.6

#!/usr/bin/python3.6   
import subprocess
import re
import requests

# Store Mac address of all nodes here
saved = {
    'xx:xx:xx:xx:xx:xx': 'My laptop',
}

# Set wireless interface using ifconfig
interface = "wlp4s0"

mac_regex = re.compile(r'([a-zA-Z0-9]{2}:){5}[a-zA-Z0-9]{2}')


def parse_arp():
    arp_out = subprocess.check_output(f'arp -e -i {interface}', shell=True).decode('utf-8')
    if 'no match found' in arp_out:
        return None
    
    result = []
    for lines in arp_out.strip().split('\n'):
        line = lines.split()
        if interface in line and '(incomplete)' not in line:
            for element in line:
                # If its a mac addr
                if mac_regex.match(element):
                    result.append((line[0], element))
    return result


def get_mac_vendor(devices):
    num = 0
    for device in devices:
        try:
            url = f"http://api.macvendors.com/{device[1]}"
            try:
                vendor = requests.get(url).text
            except Exception as e:
                print(e)
                vendor = None

        except Exception as e:
            print("Error occured while getting mac vendor", e)

        num += 1
        print_device(device, num, vendor)
    
def print_device(device, num=0, vendor=None):
    device_name = saved[device[1]] if device[1] in saved else 'unrecognised !!'
    
    print(f'\n{num})', device_name,  '\nVendor:', vendor, '\nMac:', device[1], '\nIP: ',device[0])

if __name__ == '__main__':
    print('Retrieving connected devices ..')

    devices = parse_arp()

    if not devices:
        print('No devices found!')
        
    else:
        print('Retrieving mac vendors ..')
        try:
            get_mac_vendor(devices)
            
        except KeyboardInterrupt as e:
            num = 0
            for device in devices:
                num += 1
                print_device(device, num)
0

I connected my phone to the network and used the awesome Fing app (for Android and iPhone) to scan the clients connected.

0

Arpalert - ARP traffic monitoring

If you want to maintain a list authorized MAC addresses manually.

This software is used for monitoring ethernet networks. It listens on a network interface (without using 'promiscuous' mode) and catches all conversations of MAC address to IP request. It then compares the mac addresses it detected with a pre-configured list of authorized MAC addresses. If the MAC is not in list, arpalert launches a pre-defined user script with the MAC address and IP address as parameters. This software can run in deamon mode; it's very fast (low CPU and memory consumption). It responds at signal SIGHUP (configuration reload) and at signals SIGTERM, SIGINT, SIGQUIT and SIGABRT (arpalert stops itself).

sudo apt install arpalert
cp /etc/arpalert/arpalert.conf ~/.config/  # read it for more info

arpwatch (apropos arpwatch/dpkg -L arpwatch | grep bin for its commands) could also help with those arp spoofing attacks.


With nmap:

nmap -sn 10.0.0.0/24

With ip (modern alternative to arp):

ip neigh show

Where 10.0.0.0/24 is your LAN mask, check ip addr. -sn: Ping Scan - disable port scan (check nmap man page).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .