I'm looking at trying to identify IOT devices which is sitting on my network. Any suggestions on what I can look for? Common ports being open? User agents?

closed as too broad by S.L. Barth, Matthew, grochmal, Xander, Dmitry Grigoryev Nov 17 '16 at 11:14

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


You want to look for "things" on your network, from cameras, coffee makers, and pedometers, and you are hoping there is some commonality?

I think you need to take a whitelisting approach and define what is allowed/expected, then investigate/suspect everything that is not that.

Laptops and desktops are more likely to have identifiable MACs, but what commonly makes an "IOT" is a cheap NIC, which means a generic MAC (a.k.a "general purpose" in nmap). But there is a lot on a network that will have cheap NICs, like printers, routers, and other "things" that make your network function.

User agents will only apply to those devices that connect through HTTP in a standard way, but there is no reason an IOT device has to do this. MQTT traffic is one efficient way to communicate data up to a IOT server, and there are multiple custom protocols, too.

It will be a lot easier if you define either what is allowed, or define what specific type of "thing" you want to identify. Your stated goal is to locate an undefined set of "things", and the challenges to do that will be easy to identify.

  • Precisely: I am expecting ONLY Corporate laptops and desktops to be installed on the Corporate network. My question is what I can look for on the network that would be a give away that it isn't an 'approved' business device AKA an IOT Device. – KingJohnno Nov 16 '16 at 23:18
  • My answer is above: define what you approve because that is a smaller set of variables. "Things" is undefined (despite the popular catchphrase). – schroeder Nov 17 '16 at 7:42

I would suggest using MAC address vendor prefixes and any open services on the devices to fingerprint them. Nmap offers OS detection with the use of the -O flag and provides

a freeform textual description of the OS, and a classification which provides the vendor name (e.g. Sun), underlying OS (e.g. Solaris), OS generation (e.g. 10), and device type (general purpose, router, switch, game console, etc). Most fingerprints also have a Common Platform Enumeration (CPE) representation, like cpe:/o:linux:linux_kernel:2.6.

Although I haven't personally tried fingerprinting any IoT devices, I found a few sample scans here.

The devices in the sample scans were categorized under "general purpose" (with the exception of the Nintendo Wii U). Some devices were also shown as running an embedded version of Linux, which could indicate an IoT device. Nmap also performs MAC vendor lookups, which could be unique to certain devices (e.g. the Wii's vendor was identified as "Nintendo Co").

  • Unfortunately, a 'general purpose' MAC and embedded Linux could be a lot of different things (including printers and routers, from my experience). – schroeder Nov 16 '16 at 7:55

Not the answer you're looking for? Browse other questions tagged or ask your own question.