How to read the data of a dhcp server?

Question

I want to know about all the device that are connected to the dhcp server. I have the IP of the device it may be a android phone or printer but I think dhcp is having the information of this devices.

I got something like the "vendor information " in the dhcp protocol stack.

My doubt is I have to identify at least a android phone is on the network , Is it possible by this.or how to Identify a android phone is one the network.I have the IP of the android also but I am not getting any information from any way.

I got something like nmap but this tool is not giving a perticular details of the phone.The information provided by the nmap is confusing I am not able to identify whether it is a phone or a linux system as both the system having linux as the os.

Then i got this dhcp -vendor information : but I don't have any idea about how to read these data..

kindly give any suggestion.....Needed for my project.

Thanks

Answer 1

The problem you will have is that modern day switches will stop you sniffing traffic destined for specific MAC addresses so if its hard-wired then you are going to run into trouble. If on the other-hand its a unsecured WiFi connection, or a network with hubs (rare now!) rather than switches then you may have a chance.

You'd need to switch the ethernet controller into promiscuous mode and listen for the DHCP REQUEST and DHCP OFFER commands, inspect the contents and see whats going on.

Another method would be to listen for ARP and RARP requests on the network and use a hardware lookup table for the MAC id to determine who makes the chip-sets, its not going to give you awesome accuracy since a lot of chips are re-used on different devices but it may give you a little bit more info.

In terms of the DHCPd server, unless you have access to that physical machine I'm afraid your probably out of luck, DHCP is a designed as a offering protocol, not a querying protocol.