In the recent DDoS (Distributed Denial of Service) attacks that affected Internet access on the east coast, millions of infected network devices such as routers, cameras, DVRs, and other network devices simultaneously sent out DNS (Domain Name System) requests targeting specific DNS servers. This attack essentially overwhelmed those DNS servers, resulting in anyone who uses those servers unable to surf the Internet.
Perhaps one of the devices on your network is infected and participated in this attack? How would you know? This article will show you how to find all the devices using your network and see a bit about what they're up to. I'll be using a Linksys LRT224 router and Ubiquiti UniFi Wi-Fi Access Point to illustrate the techniques. The menus and options on other network equipment may vary, but the screenshots shown below should give you the general idea of each point.
It's important to know the devices using your network, especially since Wi-Fi makes it possible for people to get on your network from outside your house.
There are automatic network tools for device discovery, which I'll discuss next. But only active devices will be discovered with these automatic tools. So it is useful to also do a physical inventory. Walk around your entire location and write down the make and model of all devices that connect to your network, and how they are connected. Here's my list:
Next, look at the DHCP (Dynamic Host Configuration Protocol) table of your router. To communicate on a network, a device needs an IP address. Most devices that connect to a network get an IP address from a DHCP server, which is typically running on your router. Your router maintains a DHCP table that lists the IP addresses it has issued over a period of time, typically the last 24 hours.
Log into your router and look for a menu option that says DHCP. On my Linksys LRT224 router there is a menu called DHCP and a submenu called DHCP Status that provides a listing of devices that have received an IP address in the past 24 hours, shown below.
Note the DHCP table will show all wired and Wi-Fi devices on your network that have received an IP address via DHCP. Devices that have been configured with a static IP address, such as my network switches, won't show up in the DHCP table. Devices that haven't been turned on in the past 24 hours or more, such as my PS3, also don't show up in the DHCP table.
Your router may behave differently. Some routers' DHCP tables show all the devices that have ever been issued an IP address since the router was powered up.
Another tool to determine devices on your network is to look at the devices connected via Wi-Fi. In addition to the DHCP table, most Wi-Fi routers have a menu to see connected Wi-Fi clients. I use a UniFi Access Point for Wi-Fi on my network. The screenshot below shows I currently have an iPhone, iPad and laptop connected to my Wi-Fi network.
Wi-Fi Client Listing
Since all three of these Wi-Fi devices are using DHCP to get an IP address, they are also displayed in the DHCP table shown previously.
There are also automatic tools for device discovery. Fing makes network scanner devices, as well as free apps that run on Apple and Google handhelds and tablets. Load and fire up Fing on your phone and within seconds it will discover virtually every active device on your network and produce a list of those devices by IP address and MAC address. Devices with both static and DHCP issued IP addresses will be discovered.
Fing may also display the device's name and manufacturer. It's a good idea to name your devices if you can; device names can often be configured on the device. For example, on a Windows PC, you can assign the Computer name in Control Panel > System Properties, under Computer description. On an iPhone, you can assign the device name in the Setting > General > Name menu. The manufacturer's name is discovered based on the first 6 characters of the device's MAC address.
To give Fing a challenge, I turned on a bunch of extra devices in my network to see how many would be discovered. Below is a screenshot of the devices Fing discovered on my network within seconds.
Fing Device Detection
It's a good idea to go through both the DHCP table and the Fing discovery output to make sure you recognize all the devices currently using your network. An unknown device could simply be something your kids added that you don't know about, or an appliance that you didn't know had Wi-Fi. It could also be an indicator that someone you don't know is using your network, perhaps an unauthorized user on your Wi-Fi!
If you discover a physical device you don't think should be on your network, or one you aren't using, disconnect it and turn it off. If there is an unidentified Wi-Fi device using your network, change your Wi-Fi SSID and security key immediately!