I would like to learn how to find the private IP address of anyone connected to a network.

This specific network has a firewall. The only info I have on it is that it blocks ICMP requests (I'm pretty sure ping sends and receives ICMP requests) no matter who you are sending these requests to. The error message goes something like Communication prohibited by filter and it shows some info. After pressing ctrl + c, I see 100% packet loss.

I've done some research and I've found that running commands like arp -a, netstat -r, and nmap -sP <ip address> (I found somewhere that -sP is deprecated for some reason and should be replaced with -sn) would show all connected devices on your network. However, I don't see everything. Normally, I would find someone's IP address through these commands by looking on the left, which shows the computer's name (such as john's MacBook Air) and then looking on the right of that (which shows the IP address). However, I get a lot of question marks on the left when running arp -a, I don't see the person I'm looking for in netstat -r, and both nmap commands don't show any ip addresses.

I know the default gateway of the network but when I used nmap to scan on that, it doesn't show anything. Does anyone know what I'm doing wrong?

I forgot to mention that when running arp -a or netstat -r I see some devices and their IP addresses. I think what I'm trying to ask is, why are some devices showing up on these scans and some others aren't?

  • Firewalls, routers, and other network devices generally block the kind of lookups you are attempting. It is literally the reason the firewall exists: to prevent you from seeing what's on the other side. Generally the only way to map a network subnet is to have a connection directly to that network - i.e. you must be able to logon normally to a host there and run the commands from that host. Also, unless you are a legitimate admin of that network doing this for work purposes, the that kind of scanning/mapping can easily be considered a violation of user access agreements, or even illegal. – pmdba Mar 3 at 4:32
  • 1
    Are you within the network (on the local side of the router/gateway) or outside of it? If you're within it, port-scans and watching ARP and so on might work. If you're outside of it, then they definitely will not if the router uses NAT. – CBHacking Mar 3 at 4:34
  • @CBHacking I'm connected to the network, if that's what you mean by within the network – Matthew Schell Mar 3 at 11:56
  • @pmdba I found 2 computers that seem like hosts through one of those commands. I was able to map both of them and get more information. I know it is illegal without permission but if i wanted to run these kind of network mapping commands, would i have to connect to one of those computers and run it through them? – Matthew Schell Mar 3 at 11:57
  • Are these other computers on the same network segment as yours? – Jasen Mar 3 at 20:28

If a system is unresponsive to (or actively blocks) conventional methods of fingerprinting, and you're convinced that the system is actually there (and is reachable), I recommend you start eavesdropping.

Ex: Start WireShark with a network card in monitor mode. Leave it running for 10-120 minutes. Afterwards, you'll want to get a list of the unique IPs it registered:

tshark -r input.pcap -T fields -e ip.dst ip.src | sort | uniq

(Where input.pcap was the pcap file you got from wireshark)[2]

Tying back the IP to a certain person will require manual work from your part. Unless the target is using DoH, you should be able to see DNS queries, so I'd recommend you start with that.

  • Hey @Pinkdev1. Just to be clear, this method will capture network traffic and will most likely show info about other computers i'm looking for? – Matthew Schell Mar 6 at 16:21
  • Yeah. It'll intercept all in-range traffic, from all of the nearby devices. Most of it will be useless, due to HTTPS, but as I said you'll prob have more luck with DNS. – Pinkdev1 Mar 6 at 16:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.