Network discovery. How does Fing work? (a network tool)

tcpdump

You may or may not know the app "Fing". It is a bunch of network tools, available on Android and iOS at least and maybe on others devices but not sure.

The main goal of this tool is to browse for everything connected on the same WiFi network, and display some informations such as MAC addresses, IP addresses, names of devices, brand/model/manufacturer (if available). It is really powerful even in its free version and I would really like to know how it works.

One thing that is interesting me is that is it able to detect devices even when they are sleeping and I really don't know how.

What I have observed/tried this:

  • I have a sleeping iPhone on IP XX.XX.XX.200 (on subnet 255.255.255.0)
  • I ping this iPhone with my laptop (Mac OSx Yosemite), no response at all, the phone seems to sleep
  • I download and install the app "Fing" on an Android device (new installation from scratch, on a new device which has never talked with the iPhone)
  • Launch the app, and … it finds my phone on XX.XX.XX.200, it finds its brand and model, and MAC address

(during the whole test, no response at all to my ping request on the Mac) This really intrigues me.

How can this work ?

So I have continued my investigations, and I got the idea of sniffing what is coming from this application.
I have set up a TCPDump listener on the Mac, and launch the app again. So I have sniffed everything going from the app to my laptop. And here is what I obtained :

enter image description here

This is only a partial screenshot as there are more sniffed packets. It continues in the terminal but the rest looks the same.

I am wondering two things. If we randomly observe one line, for example this one :

11:47:23.914998 IP 10.11.204.34.mdns > 224.0.0.251.mdns: 0 PTR (QM)? 22.204.11.10.in-addr.arpa. (43)

I understand that the app with the IP 10.11.204.34, sends a multicasted message to 224.0.0.251. But what is this message ? And what is 22.204.11.10.in-addr.arpa. (43) ? And why are they so many packets to or from XX.204.11.10.in-addr.arpa. ?

This is a long question, and I thank you in advance for reading everything. And thank you for having reached this line.

Best Answer

The last part of your question:

What is 11:47:23.914998 IP 10.11.204.34.mdns > 224.0.0.251.mdns: 0 PTR (QM)? 22.204.11.10.in-addr.arpa. (43)

It is a multicast DNS lookup, the ip at the end is a reverse lookup IP->Name the ip is specified in revese order.

Thus the device 10.11.204.34 is trying to find a dns name for 10.11.204.22.

Multicast_DNS

Related Topic