Lookup ARP table in addition to normal ping in LAN to detect "hiding" hosts

[jnmills]

I have a number of hosts which Angry IP scanner does not report - unless you have it set to "All scanned hosts" mode - when you get all the empty IP addresses too.

These are Windows 10 systems and Android Phones - and they are well firewalled off to not respond to Ping, and often have no open ports either.

Angry IP does locate these hosts and find a MAC address for them, and a name (presumably from the ARP table and DNS lookup), but because no ping or ports the display filter removed them. It still displays them with a red dot to the left of the line as uncontactable.

I tried the various "pinging methods" to see if the functionality was included in there, but it does not seem to reveal them - although "Java Built in" does better than most.

It could be improved by noting that an MAC address entry for the host exists in the ARP after the initial attempt to ping, revealing that the host is actually there.

To Reproduce
Steps to reproduce the behavior:

1. Try and scan a Windows 10 PC (secured by Defender r Norton if that makes a different)
2. Note that an attempt to "ping" from a dos window fails
3. Run Angry IP on that MAC access with display mode set to "All Scanned hosts" and Java Built In"
4. Note that although it has a Name, MAC address and other details - it still says it is down.

Expected behavior
It should be displayed as connected/up

Screenshots
If applicable, add screenshots to help explain your problem.

Versions (please complete the following information):

• OS type and version Windows 10 Ver 20H2 build 19042.804
• Java version, 32 or 64 bit, how was installed (java -version) 1.8.0_281-b09 64bit
• Version of Angry IP Scanner 3.7.4

Logs:

• Please run Angry IP Scanner from command-line and see if any relevant logs were written. Paste them here.

Nothing output on command-line run

[DrJaymz]

Yes, basically it doesn't work. I have 4 devices it cannot see, but I can ping them and nmap sees them fine and I tried the options to try different methods, but it doesn't do what it says on the tin. So I reverted to nmap. So I'd suggest for you on windows to try advance ip scanner because you we're not even acknowledged on here.

[angryziber]

@DrJaymz it would be really nice get some help with debugging of these devices to understand what is different with them.
In general, Angry IP Scanner uses the same function as the ping utility on Windows by default, so they should give the same results if devices respond to ICMP echo requests.

[DrJaymz]

What do you need from me? I can run nmon and compare, or script to ping all 255 addresses and compare. I'm currently using fing desktop and again can compare the output.

…

On Sun, 16 Jan 2022, 22:00 Anton Keks, ***@***.***> wrote: @DrJaymz <https://github.com/DrJaymz> it would be really nice get some help with debugging of these devices to understand what is different with them. In general, Angry IP Scanner uses the same function as the ping utility on Windows by default, so they should give the same results if devices respond to ICMP echo requests. — Reply to this email directly, view it on GitHub <#280 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AKDQBPCB36NGQZNITT4OZVLUWM5XFANCNFSM4X6E6BIQ> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[angryziber]

@DrJaymz please describe what is special about the hosts that are not detected. Is it the same as with the original post that they are configured to not to respond to ICMP/TCP/UDP requests? Or if you can ping them from command-line, what could be special about them? Are these always the same devices that are not seen?

[angryziber]

Will be released soon. On my network ARPPinger discovers a TV set-top box that is not visible otherwise