1. Overview
In a wireless network environment, it is essential to have visibility and control over the devices connected to the wireless access point (AP). This knowledge helps to manage and secure the network effectively.
In this tutorial, we’ll explore a few methods to list the connected devices on a wireless access point in Linux.
2. Finding Wireless AP IP Address
Before scanning the network to list the connected devices in the wireless access point, we need to identify the wireless AP IP address. For this, we’ll open a terminal and execute the ip route command along with grep to display the line containing default which represents the default gateway:
$ ip route | grep default
default via 192.168.1.254 dev wlan0 proto dhcp src 192.168.1.188 metric 600
The command output displays the gateway IP address, i.e., 192.168.1.254, which is also the IP address of the wireless access point.
3. Using nmap
The nmap (Network Mapper) is a powerful open-source network scanning tool for discovering devices and their services on a network. Here’s how we can leverage nmap to list the connected devices on a wireless access point.
3.1. Install nmap
Let’s install nmap on a Linux system if it isn’t already installed:
$ sudo apt-get install nmap
3.2. Run the nmap Command
Then, let’s run the nmap command to list the connected devices in the wireless access point. We’ll use the -sn option in nmap to launch the ping scan. It sends ICMP Echo Request (ping) packets to the target hosts and determines their online/offline status based on the responses received over the wireless network range:
$ nmap -sn 192.168.1.254/24
Starting Nmap 7.92 ( https://nmap.org ) at 2023-05-31 08:29 +0545
Nmap scan report for 192.168.1.64
Host is up (0.0055s latency).
MAC Address: 00:42:23:01:C7:48 (Netcore Technology)
Nmap scan report for dsldevice.lan (192.168.1.254)
Host is up (0.0064s latency).
Nmap done: 256 IP addresses (2 hosts up) scanned in 2.70 second
The command performs a ping scan on the specified IP range, and the output displays the IP addresses and MAC addresses of the devices connected to the wireless access point. Additionally, the /24 denotes the subnet mask, which indicates the scan should cover all IP addresses in the same network.
4. Using arp-scan
Another useful *tool for listing connected devices on a wireless access point is the arp-scan.* It scans the local network and retrieves active devices’ IP and MAC addresses.
4.1. Install arp-scan
Let’s install arp-scan on a Linux system with the following command:
$ sudo apt install arp-scan
4.2. Run the arp-scan
After installation, let’s open a terminal and perform a scan to list the connected devices. Here, we’ll add –interface=wlan0 to perform an ARP scan over the wireless interface, i.e., wlan0 in the local network:
$ sudo arp-scan --interface=wlan0 --localnet
Interface: wlan0, type: EN10MB, MAC: 52:e1:6d:f2:a3:e6, IPv4: 192.168.1.188
Starting arp-scan 1.9.7 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.1.64 00:42:23:01:C7:48 Netcore Technology Inc.
192.168.1.254 18:72:63:61:33:D0 (Unknown)
192.168.1.72 21:45:39:21:11:42 (Unknown)
...
The command scans the local network and provides a list of connected devices along with their IP and MAC addresses in the wireless access point.
5. Using netdiscover
The netdiscover is a powerful command-line tool for network scanning and device discovery in Linux. With its ability to quickly identify devices connected to a wireless access point, netdiscover provides a convenient method for gaining insights into the network. Further, we’ll explore how to use netdiscover to discover connected devices on a wireless access point in Linux.
5.1. Install netdiscover
Similar to the installation of arp-scan, we can install netdiscover with the following command on a Linux system:
$ sudo apt-get install netdiscover
5.2. Run the netdiscover
Once we install netdiscover, we execute the netdiscover command along with the -r option to scan the range for listing connected devices in the network:
$ sudo netdiscover -r 192.168.1.254/24
Currently scanning: Finished! | Screen View: Unique Hosts
34 Captured ARP Req/Rep packets, from 18 hosts. Total size: 1626
_____________________________________________________________________________
IP At MAC Address Count Len MAC Vendor / Hostname
-----------------------------------------------------------------------------
192.168.1.79 4c:88:21:bc:3f:95 4 168 SAMSUNG ELECTRO-MECHANICS(THAILAND)
192.168.1.83 38:42:7e:23:e6:98 2 84 Unknown vendor
192.168.1.254 18:72:63:61:33:D0 9 522 Taicang T&W Electronics
192.168.1.88 84:c7:a2:38:0f:f6 2 84 Intel Corporate
The command output provides the connected devices’ IP addresses, MAC addresses, and manufacturer information. Furthermore, netdiscover provides information about the manufacturer of each device in the Vendor column, allowing us to identify the device brands.
6. Using Nutty
Nutty is a handy and user-friendly GUI tool that provides a graphical interface for managing various network management tasks in Linux. Similarly, it offers an intuitive way to view and manage devices connected to the wireless access point.
6.1. Install Nutty
Let’s begin by installing Nutty on the Linux system. The installation method may differ based on the Linux distribution. For example, if we are using Ubuntu or Debian, we can install Nutty by running the following command in the terminal:
$ git clone https://github.com/babluboy/nutty.git
$ cd nutty
$ meson build --prefix=/usr
$ cd build
$ ninja
$ sudo ninja install
Once we install Nutty, we can launch it from the applications menu or by searching for Nutty in the system launcher.
6.2. Run Nutty
After launching Nutty, we can select the wireless interface connected to the wireless access point from the left-hand side panel. The interface name can be wlan0 or similar.
In the Nutty interface for a wireless interface, we can find a connection type option where we select the connection type (in this case, wlan0). Let’s click on the wlan0 and go to the devices tab on the right to view the list of connected devices on the wireless access point:
Nutty will display relevant information such as the device name, IP address, MAC address, and connection status.
Here is what the colored dots next to each Device Name mean:
- Green: The device is currently connected and actively communicating with the wireless access point
- White: The device is connected to the wireless access point but might not be actively communicating or using the network at that moment
7. Conclusion
In this article, we explored several methods to list connected devices on a wireless access point in Linux.
By leveraging tools such as nmap, arp-scan, netdiscover, and Nutty, we can gain visibility into the devices connected to the wireless network.