Success is neither magical nor mysterious. Success is the natural consequence of consistently applying basic fundamentals.
~ E. James Rohn.
Hi guys, last week I worked on a vanilla Windows 10 client computer without internet, but it was connected to a LAN with many computers. The machine had no third party tools, no nmap, no network scanners, nothing but the operating system itself, and I needed a list of the live machines on the network.
I asked myself how to get all alive computers in the network using only built in tools from Windows. The answer turned out to be two commands I had known for years, working together in a way I had never tried.
🔔 Wake the Network Up
First thing I did was ping the broadcast address using ping <broadcast ip> -t -i 4. This will ping the broadcast IP, and this action will spread and send the message to all active computers in the network. You can find your broadcast IP by taking your LAN IP and flipping the host portion, or simpler, by checking ipconfig for the subnet and doing the math (e.g., for 192.168.1.x with a 24-bit mask, the broadcast is usually 192.168.1.255).
The reason this works is that Windows hosts on a LAN, including ones that block ICMP from strangers, usually respond with an ARP exchange when any packet is addressed to the broadcast. The ping is not the discovery itself; it is the doorbell that makes everyone reveal themselves.
📋 Read the ARP Table
After that we would wait for around 5-10 seconds, and execute the follow up command which is arp -a. The arp command will check the address resolution protocol and list it down. After the ping stirred everyone up, the ARP table on your machine now contains an entry for every host that answered, with both IP and MAC address, which is better than a simple ping sweep because it also gives you the hardware addresses.
The -i 4 on the ping command instructs to ping only on the IPv4 (Internet Protocol Version 4) network. That’s all there is to it. Kindly check the manual page of the commands for different flag combinations, since arp -a has variations on other systems.
🧠 Final Thoughts
Two built-in commands, zero installations, and you have a census of your LAN: ping the broadcast, read the ARP table. It is the kind of trick that looks trivial once you know it, and it has saved me more than once on locked-down machines.
Keep it in your pocket for the next time a client machine needs a network inventory and the admin forgot the scanner tool. Thanks for reading!
❌ Originally posted on August 18, 2019