61

I want to be able to discover Android devices on my network and possibly retrieve some device information about them. This is very easy with Apple devices since they run Bonjour services. However, I can't seem to find any similar service running on Android.

This must work without modifying the Android device, installing some service, or opening some port. It's meant to work with vanilla Android devices in the way that Bonjour helps you find vanilla Apple devices. Even being able to just verify that the device is running Android would be sufficient.


Chosen Answer: Although it's not the top rated answer (yet), please take a look at the response by Luis. As he mentions, you can use a DNS lookup (using your local DNS server) to discover Android devices. I have found this to have a 100% success rate, as Android forces devices to use a hostname of android-_____. This is apparently difficult to change on the phone, even if it is rooted. So I think this is a pretty accurate method. Thanks, Luis!

Example:
$ nslookup 192.168.1.104 192.168.1.1
Server:     192.168.1.1
Address:    192.168.1.1#53

104.1.168.192.in-addr.arpa  name = android-711c129e251f14cf.\001.

Sample Code: If you wanted to implement this in Java (e.g., to run on Android), you can't easily use getHostName() because it uses the external DNS servers. You want to use the local DNS server on your router, for example. Luis mentions below that you could modify the DNS servers of the Wifi connection, but that could possibly break other things. Instead, I've found the dnsjava library to be extremely helpful to send targeted DNS requests. Here is some sample code using the library:

        String ipAddress = "104.1.168.192";
        String dnsblDomain = "in-addr.arpa";
        Record[] records;
        Lookup lookup = new Lookup(ipAddress + "." + dnsblDomain, Type.PTR);
        SimpleResolver resolver = new SimpleResolver();
        resolver.setAddress(InetAddress.getByName("192.168.1.1"));
        lookup.setResolver(resolver);
        records = lookup.run();

        if(lookup.getResult() == Lookup.SUCCESSFUL) {
              for (int i = 0; i < records.length; i++) {
                if(records[i] instanceof PTRRecord) {
                  PTRRecord ptr = (PTRRecord) records[i];
                  System.out.println("DNS Record: " + records[0].rdataToString());
                }
              }
        } else {
            System.out.println("Failed lookup");
        }

    } catch(Exception e) { 
        System.out.println("Exception: " + e);
    }

This gives me the output:

DNS Record: android-711c129e251f14cf.\001.

Bingo.

12
  • Take a look at this, It might help you [Stack Link][1] [1]: stackoverflow.com/questions/6792130/network-device-discovery Nov 2, 2012 at 15:58
  • thanks, but not quite what i'm looking for! I'm looking for a way to discover Android clients without installing any service on them. That suggests installing a Bonjour service on them, and then using mDNS. Looking for something that is already "open" on Android devices to help discover them.
    – gnychis
    Nov 2, 2012 at 18:01
  • It might help if you describe your network architecture. Is the machine running discovery the Wi-Fi access point, just another Wi-Fi client on the same network, or something else?
    – jimhark
    Nov 21, 2012 at 17:15
  • bonjour or more generically dns-sd runs on top of dns on the network, this is not magic, the apple devices run a dns-sd service, android devices do not have any kind of bonjour support built in , but you can run a dns-sd service in the background such as jDMS. An exception might be if the device supports bluetooth, if you are looking for bluetooth devices than android does have support and you can scan for bluetooth devices and then query the SDDP records for device info. Otherwise your asking for magic that does not exist. Nov 21, 2012 at 19:46
  • No need for the snark "magic" comments... I understand the technical barrier and the fact that Apple devices run some sort of services (e.g, Bonjour), pre-loaded. My question is whether there exists some service on Android that I am missing that does something similar. I put the stipulation of not adding a service, because otherwise everyone would respond: "just add a bonjour service!" I understand the difference and the final answer may simply be: "there is none." That's fine, I'm poking for help. Some things that I didn't know existed tend to turn up when you ask others.
    – gnychis
    Nov 21, 2012 at 20:05

7 Answers 7

34
+300

There is an very simple approach that gave me positive results in few different devices.

When a device connects to your router it receives an IP (i.e. DHCP) and registers a name in DNS. The name that is registered seems to be always in the form android_nnnnnnnn.

Of course, you can name any computer with the same approach and trick the check, resulting in false positives ...

Also, I can't ensure that all device suppliers are following the same approach, but I've found it to work correctly in a few devices from different brands (including different SDK levels) that I've tested.

--EDITED--

How to do it

It depends on where you would be running the code to discover the Android devices. Assuming that you would be running the code in an Android device:

  1. First discover devices responding to ping in your network. You can use the code in my answer to this post: execComd() to run a ping command.

  2. Get the name of responding devices using the code:

    InetAddress inetAddress = InetAddress.getByName(string_with_ip_addr);

    String name = inetAddress.getCanonicalHostName();

--EDIT 2--

Proof of concept

The method below is just a proof of concept for what I've wrote above.

I'm using isReachable() method to generate the ICMP request, which is said to only work with rooted devices in many posts, which is the case for the device used for testing it. However, I didn't give root permissions for the application running this code, so I believe it couldn't set the SIUD bit, which is the reason why some claim that this method fails. I would like to do it here from the perspective of someone testing it on a non-rooted device.

To call use:

ArrayList<String> hosts = scanSubNet("192.168.1.");

It returns in hosts, a list of names for devices responding to ping request.

private ArrayList<String> scanSubNet(String subnet){
    ArrayList<String> hosts = new ArrayList<String>();
    
    InetAddress inetAddress = null;
    for(int i=1; i<10; i++){
        Log.d(TAG, "Trying: " + subnet + String.valueOf(i));
        try {
            inetAddress = InetAddress.getByName(subnet + String.valueOf(i));
            if(inetAddress.isReachable(1000)){
                hosts.add(inetAddress.getHostName());
                Log.d(TAG, inetAddress.getHostName());
            }
        } catch (UnknownHostException e) {
            e.printStackTrace();
        } catch (IOException e) {
            e.printStackTrace();
        }
    }
    
    return hosts;
}

Regards.

23
  • Hi Luis, could you expand on this a little bit? How do you query the network/router to check for the registered DNS name? I do in fact see an Android string in a DHCP request from an Android device, but I don't want to bank on the fact that I will overhear an infrequent request to detect it. If you have some method of querying for that DNS lame, I'd love to hear it.
    – gnychis
    Nov 24, 2012 at 9:40
  • Edited my answer with additional info.
    – Luis
    Nov 24, 2012 at 10:57
  • But see this code.google.com/p/android/issues/detail?id=6111 again close but not 100%, especially with some routers having issue with the underscore character and older devices not supporting Nov 24, 2012 at 14:19
  • research effort: A quick scan for wifi-scanners on github gives quite a few written in various languages, java seems to be the best bet because its universal, run on android , run on desktop or laptop with wifi card. github.com/… There's no one example I can point out that does what you want. but all of them is going to give you the info we've all been discussing. Set up a hierarchy of checks from most like to least likely , so first resolve host from ip, and see if you can see android_xxxx, that should catch anything 2.2.4 above Nov 24, 2012 at 15:02
  • now check macaddress , manufacturer, anything that you can resolve from the scan. I would built a simple scanner get a result back and analyzed what I can use be it macaddress, manufacturer, host name etc. there may be some devices that show as *, so macaddress, manufacturer, wifi-card maker (broad com etc..), these would be the 2.1 and lower devices which is about 12% or so of the android ,market, if for some reason a device can't register at all we don't care about those. those with missing hostnames should be caught by the other tests. Nov 24, 2012 at 15:10
21

Android is not going to be as easy as iOS. There is no Bonjour equivalent.

Android 4.0, Ice Cream Sandwich, introduced Wi-Fi Direct Peer to Peer networking. At first I hoped it might be able to be scanned in the the way your thinking, but it helps Android devices communicate without an access point, so they're not really "on your network". Besides, ICS runs on only a fraction of Android devices.

Rather than an active netscan approach, you're left with a passive monitoring approach. If your network is secure, sniffing the encrypted packet is possible, but inconvenient. You'll have to

  • put your network interface into monitor mode
  • capture the 4-way handshake
  • decrypt it using the network's pre-shared key
  • this will give you the key you need to decrypt traffic

If you want to see this in action, Wireshark supports WPA decryption.

Once you're able to view the Wi-Fi traffic, you will notice Android devices tend to communicate with certain Google servers and their HTTP connections have User Agent strings that can be identified. This is the basis for a workable passive solution.

Tenable Network Security offer products that seem to take this type of approach.

Another Idea

@Michelle Cannon mentioned Libelium's Meshlium Xtreme whose approach will not get you all the way there (not without good up to date MAC address range tables). But it could be part of reaching a lesser goal. You can:

  • Detect all wireless devices
  • Eliminate Apple devices using the MAC's Organizationally Unique Identifier (OUI)
  • Tell it's a mobile device by by monitoring signal strength to determine it's moving (and mobile devices will tend to show up and go away)
  • You may be able to use the MAC OUI as a hint it's Android
  • You may be able to use the MAC OUI as a hint it's not Android (but a laptop or wireless card, etc.).

This may be workable if your willing to detect devices that are probably Android.

DHCP Fingerprinting

@Michelle Cannon suggested DHCP fingerprinting. I wasn't sure at first but I have to thank him for suggesting what's looking like the best bet for simple passive scanning. As a cautionary tail, I'd like to explain why I was late to the party.

There are things we know, thinks we don't know, and things we think we know but are wrong.

In a lot of ways, it's good that Android uses the Linux kernel. But it's not good if you want to discover Android devices on your network. Android's TCP/IP stack is Linux's therefor Android devices will look like Linux devices or so I thought at first. But then I realized Linux has a lot of build configuration parameters so there could be something distinctive about Android when seen on a network, but what?

DHCP fingerprinting uses a the exact DHCP options requested by the device plus timing. For this to work you generally need an up to date fingerprint database to match against. At first it looked like fingerbank was crowed sourcing this data, but then I noticed their files hadn't been updated for almost a year. With all the different Android device types, I don't think it's practical to keep updated fingerprints for a single project.

But then I looked at the actual DHCP signatures for Android and I noticed this:

Android 1.0:     dhcpvendorcode=dhcpcd 4.0.0-beta9
Android 1.5-2.1: dhcpvendorcode=dhcpcd 4.0.1
Android 2.2:     dhcpvendorcode=dhcpcd 4.0.15
Android 3.0:     dhcpvendorcode=dhcpcd-5.2.10 

Linux normally uses dhclient as their DHCP client, but Android is using dhcpcd. Android has a strong preference for using software licensed with the BSD style where possible and dhcpcd uses a BSD license. It would seem dhcpvendorcode could be used as a strong indicator that a mobile device is running Android.

DHCP monitoring

A client uses DHCP to get an IP address when joining a network so it's starting without an IP address. It gets around this problem by using UDP broadcasts for the initial exchange. On Wi-Fi, even with WPA, broadcast traffic is not encrypted. So you can just listen on UDP port 67 for client to server traffic and 68 for the reverse. You don't even need to put your network interface into promiscuous mode. You can easily monitor this traffic using a protocol analyzer like Wireshark.

I preferred to write code to monitor the traffic and decided to use Python. I selected pydhcplib to handle the details of DHCP. My experience with this library was not smooth. I needed to manually download and place IN.py and TYPES.py support files. And their packet to string conversion was leaving the dhcpvendorcode blank. It did parse the DHCP packets correctly, so I just wrote my own print code.

Here's code that monitors DHCP traffic from client to server:

#!/usr/bin/python
from pydhcplib.dhcp_packet import *
from pydhcplib.dhcp_network import *
from pydhcplib.dhcp_constants import *


netopt = {
    'client_listen_port':"68",
    'server_listen_port':"67",
    'listen_address':"0.0.0.0"
}

class Server(DhcpServer):
    def __init__(self, options):
        DhcpServer.__init__(
            self,options["listen_address"],
            options["client_listen_port"],
            options["server_listen_port"])

    def PrintOptions(self, packet, options=['vendor_class', 'host_name', 'chaddr']):

        # uncomment next line to print full details
        # print packet.str()

        for option in options:
            # chaddr is not really and option, it's in the fixed header
            if option == 'chaddr':
                begin = DhcpFields[option][0]
                end = begin+6
                opdata = packet.packet_data[begin:end]
                hex = ['0','1','2','3','4','5','6','7','8','9','a','b','c','d','e','f']
                print option+':', ':'.join([(hex[i/16]+hex[i%16]) for i in opdata])
            else:
                opdata = packet.options_data.get(option)
                if opdata:
                    print option+':', ''.join([chr(i) for i in opdata if i != 0])
        print

    def HandleDhcpDiscover(self, packet):
        print "DHCP DISCOVER"
        self.PrintOptions(packet)
    def HandleDhcpRequest(self, packet):
        print "DHCP REQUEST"
        self.PrintOptions(packet)

    ##  def HandleDhcpDecline(self, packet):
    ##      self.PrintOptions(packet)
    ##  def HandleDhcpRelease(self, packet):
    ##      self.PrintOptions(packet)
    ##  def HandleDhcpInform(self, packet):
    ##      self.PrintOptions(packet)


server = Server(netopt)

while True :
    server.GetNextDhcpPacket()

This code is based on pydhcplib's server example because it listens for client requests, like a server.

When my Nexus 7 Android 4.2 tablet connects, this interesting information is captured (redacted):

DHCP REQUEST
vendor_class: dhcpcd-5.5.6
host_name: android-5c1b97cdffffffff
chaddr: 10:bf:48:ff:ff:ff

DHCP DISCOVER
vendor_class: dhcpcd-5.5.6
host_name: android-5c1b97cdffffffff
chaddr: 10:bf:48:ff:ff:ff

The host name seems to have a fixed format and is easily parsed. If you need the IP address you can monitor the server to client traffic. Note: only the initial exchange, when an new client first shows up without an IP address, is broadcast. Future lease extensions, etc., are not broadcast.

Reverse DNS Lookup

@Luis posted a great solution that demonstrates how simpler is better. Even after seeing Android's DHCP client was setting host_name to android-5c1b97cdffffffff, I didn't think to ask the router for it's list of names using reverse DNS lookups. The router adds the host_name to it's DNS server so you can still access the device if its IP address changes.

The host_name is expected to remain listed in the DNS for the duration of the DHCP lease. You could check if the device is still present by pinging it.

One drawback to depending on host_name is there are ways this could be changed. It's easy for the device manufacturer or carrier to change the host_name (though after searching, I've been unable to find any evidence they ever have). There are apps to change host name, but they require root so that's, at most, an edge case.

Finally there's an open Android Issue 6111: Allow a hostname to be specified that currently has 629 stars. It would not be surprising to see configurable host_name in Android Settings at some point in the future, maybe soon. So if you start depending on host_name to identify Android devices, realize it could be yanked out from under you.

If you're doing live tracking, another potential problem with Reverse DNS Lookup is you have to decide how frequently to scan. (Of course this is not an issue if you're just taking a one-time snapshot.) Frequent scanning consumes network resources, infrequent leaves you with stale data. Here's how adding DHCP monitoring can help:

  • On startup use Reverse DNS Lookup to find devices
  • Ping devices to see if they are still active
  • Monitor DHCP traffic to detect new devices instantly
  • Occasionally rerun DNS Lookup to find devices you might have missed
  • If you need to notice devices leaving, ping devices at desired timing resolution

While it's not easy (nor 100% accurate), there are several techniques that make it possible to discover Android devices on your network.

6
  • thanks for the response! I am digging around Wi-Fi Direct documentation. The passive monitoring approach would be great, but it would break under WPA2 encryption since you can't monitor per-link traffic.
    – gnychis
    Nov 21, 2012 at 20:13
  • That's why I posted a comment to your question asking about your network architecture. It would help if the discovery machine was the AP (though I understand that's unlikely and limiting).
    – jimhark
    Nov 21, 2012 at 20:25
  • from what I am finding and the hacking exposed wireless network books are probably the best source of information is that an active scan should get you the class of device or the manufacturer , either one should help you determine if the device is android or whatever, not sure if security or a firewall would block this, and you probably have to broadcast SSID or give it to the discovery device somehow, bluetooth would be the best , but its so short range. if all clients are in a room or automobile for instance. or you have relays of some type Nov 21, 2012 at 21:08
  • You'll still be able to see broadcast traffic. Will your Android discovery system be running full time? If so you may be able to monitor WEP's 4-way handshake (RSN protocol) and collect the information needed to decrypt the session. Will the Wi-Fi network owner be the one running the discovery system? If so you may be able to justify forging de-authentication packets to help out with this.
    – jimhark
    Nov 21, 2012 at 21:10
  • bounty or no bounty this is fascinating discussion, I would recommend looking at this book, there is a lot of useful information Network Forensics: Tracking Hackers through Cyberspace By: Sherri Davidoff; Jonathan Ham Publisher: Prentice Hall Publication Date: 13-JUN-2012 Insert Date: 30-MAR-2012 Table of Contents • Start Reading unless you can utilize bluetooth sniffing or use specialized hardware your server will have to function as a kind of sniffer. Nov 21, 2012 at 21:30
5

AFAIK, Android system doesn't provide any zeroconf app/service on it's built-in system app/service stack. To enable the auto-discovery on the actual device attached to local network, you need either install some third-party zeroconf app or develop your own app/service and install it on the actual device, some API options are:

I am not quite clear about your requirements, if you want something similar (i.e. auto discover and connect) on vanilla Android devices, you can probably use Wi-Fi direct which is now available on some later device running Android 4.0, however, it requires both devices support Wi-Fi Direct and only create an ad-hoc P2P connection with Wi-Fi turned off, much like a bluetooth connection with a longer range:

enter image description here

For Wi-Fi Direct API support, check out official guide - Connecting Devices Wirelessly.

2

I am looking at this an thinking

http://www.libelium.com/smartphones_iphone_android_detection

pay special note to this

Do the users need to have an specific app installed or interact somehow to be detected?

No, the scan is performed silently, Meshlium just detects the "beacon frames" originated by the Wifi and Bluetooth radios integrated in the Smartphones. Users just need to have at least one of the two wireless interfaces turned on.

Long time ago I use to use an app called stumbler on my mac to find wifi networks, I think this is similar

Other ideas

Well if I need to determine android phones on a local network how would I do it. Absent of a dns service running I only have a couple possibilities

The SSID if its being broadcast - can't tell me anything The ip address - android lets you have a lot of control over host naming so I guess you could define a specific ip range to your android devices. -not to useful.

Alternately lets say I see an unknown device on the network, if bluetooth is turned on then I am broadcasting a bluetooth device signature SDPP that I can use to deduce my device type.

If I were running a service that supported android and I wanted to discover specific android devices on my network, then I could just register the mac addresses for those devices and watch for them on the network.

Other than that you would need to run either a bonjour (dns-sd) or upnpp dameon on the device.

10
  • Approach taken by Libelium's Meshlium Xtreme detects Wi-Fi devices in general. You can get the MAC address of the device. Half of which is the Organizationally Unique Identifier which can be used to identify the manufacturer. This can be used to identify Apple devices. But Android devices will have many manufacturer's most of which will make non-android devices.
    – jimhark
    Nov 21, 2012 at 21:27
  • No method is going to be 100 percent but by process of elimination you eliminate apple, probably deduce mobile from notebook so only small number of phones left , blackberry uses common WLAN card Nov 21, 2012 at 21:49
  • no any method for this involves sniffing, no other way I can see. It's not hacking if its you network , is it? the whole exercise I think is to reduce the false positives, once you've got a list of candidate devices, I assume there is some kind of client app on the android device, otherwise what would be the point of all this. What is the application anyway?? so now you query the device and eliminate the ones that don't respond back. I think they use hardware to make it easy but all the "tools" are already available, just harder to use if you DIY. Nov 21, 2012 at 21:57
  • @MichelleCannon: "I assume there is some kind of client app on the android". I'd say the client app is the Browser which sends an easily identifiable User Agent string (see my answer to this question for link). There's also other various Google software which "phone home", so you could monitor for traffic to the related Google servers.
    – jimhark
    Nov 21, 2012 at 22:10
  • actually re-reading the question, there may not actually be a client app, I'd say the approach we jointly outlined covers about 99% of the cases, the other % is going to be other tablets, phones other than blackberry, windows phone , iPhone and of course Android. Nov 21, 2012 at 23:50
1

Updated Response

Sorry, I haven't understood the original question correctly. Only your comment made it really clear to me that you do not want to have to install anything on the target devices but you just want a way of discovering random phones in your network.

I'm not sure if this would really be possible in the way you want it. Without having any network discovery service running on Android you will not find the device in first place. Of course you can use some low-level network protocols but that would only give you an indicator that there's something but not what it is (being an Android device, a PC, a whatever else).

The most promising approach would be to check for preinstalled apps that have network functionality of some kind. E.g. Samsung devices have Kies Air (if the user enables it), Motorola are using UPnP for their Media Server and HTC has something own as well, if I remember correctly. However, there's no app that is installed on all Android devices of all vendors and carriers. So you can't rely on solely one of those but would need to check for various different services using their specific protocols and behaviors in order to get additional information about the device. And, of course, the user would have to enable the functionality in order for you to use it.

Old response

An additional alternative to yorkw's list is AllJoyn by Qualcomm. It's an open source cross-platform discovery and peer-to-peer communication framework I've used in the past myself already.

Though Qualcomm is a big sponsor of AllJoyn this does not mean that you need a Qualcomm chipset in your define. In fact AllJoyn works on any chipset including Intel and nVidia. It doesn't require rooted phones or any other modifications to the Android framework and just works "out of the box" using Wi-Fi and/or Bluetooth as pairing methods.

1
1

I am learning a lot from this topic.

there is also something called dhcp fingerprinting, apparently different devices act differently to the kind of network scans we've been discussing such as those using NMAP a linux scanner. Maps of the behavior from these probes are available on the internet.

http://www.enterasys.com/company/literature/device-profiling-sab.pdf

https://media.defcon.org/dc-19/presentations/Bilodeau/DEFCON-19-Bilodeau-FingerBank.pdf

http://community.arubanetworks.com/t5/ArubaOS-and-Mobility-Controllers/COTD-DHCP-Fingerprinting-how-to-ArubaOS-6-0-1-0-and-above/td-p/11164

http://myweb.cableone.net/xnih/

3
  • one thing is clear from the research we are doing, no approach is 100% and no approach is easy. There are also orgs and hardware oem's that have answered this question and perhaps the best approach is a combination of software and hardware. Nov 22, 2012 at 0:15
  • I almost feel like writing a network scanner myself, than coming up with a countermeasure for this :-) Nov 22, 2012 at 0:46
  • you've really been posting some great links. I drilled down and did a proof of concept DHCP fingerprint in Python. I'll try to post the code with a write-up tomorrow.
    – jimhark
    Nov 24, 2012 at 23:01
-1

Here's a one liner that pings all of the machines on your network (assuming your network is 192.168.1.x) and does a reverse lookup on their names:

for i in {1..255}; do echo ping -t 4 192.168.1.${i} ; done | parallel -j 0 --no-notice 2> /dev/null | awk '/ttl/ { print $4 }' | sort | uniq | sed 's/://' | xargs -n 1 host 

Requires GNU parallel to work. You can install that on OSX using "brew install parallel"

From this you can just look at the devices named android-c40a2b8027d663dd.home. or whatever.

You can then trying running nmap -O on a device to see what else you can figure out:

sudo nmap -O android-297e7f9fccaa5b5f.home.

But it's not really that fruitful.

1
  • Note that this solution may not work for Samsung devices which allow user to name the hostname and don't often have "android" in hostname unlike other brands.
    – David
    Dec 16, 2020 at 17:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.