Finding other computers on network over command line

I've got a handful of Macs on my home network, and shell access to only one of them from the outside. How can I figure out what IP address of the other machines are?

Solution 1:

Try arp -a to see your computer's current arp table. It will show only those IP addresses your computer has interacted with. Output like this (obscured a little to hide MAC addresses on my network):

$ arp -a
? (10.1.168.1) at xx:xx:9e:82:ab:f6 on en1 ifscope [ethernet]
? (10.1.168.16) at xx:xx:29:d3:17:8 on en1 ifscope [ethernet]
? (10.1.168.115) at xx:xx:2:4f:76:14 on en1 ifscope [ethernet]
? (10.1.168.131) at xx:xx:6b:d0:36:a5 on en1 ifscope [ethernet]
? (10.1.168.134) at (incomplete) on en1 ifscope [ethernet]
? (10.1.168.137) at xx:xx:65:46:cd:b8 on en1 ifscope [ethernet]
? (10.1.168.255) at ff:ff:ff:ff:ff:ff on en1 ifscope [ethernet]
? (192.168.4.255) at ff:ff:ff:ff:ff:ff on vmnet8 ifscope [ethernet]
? (192.168.110.255) at (incomplete) on vmnet1 ifscope [ethernet]

If you don't have further information on which computer is which, you can gain a little more information by identifying the manufacturers of the network cards through MAC address lookup.

Solution 2:

Assuming all the other machines are in the same broadcast domain as the one to which you have access, pinging the broadcast address will often suffice. It will not find machines that are asleep, nor those configured to not respond to pings, nor those that will respond to pings but not to broadcast pings.

% ifconfig -a | grep broadcast
        inet 192.168.1.241 netmask 0xffffff00 broadcast 192.168.1.255
% ping -i 5 -c 2 192.168.1.255
PING 192.168.1.255 (192.168.1.255): 56 data bytes
64 bytes from 192.168.1.241: icmp_seq=0 ttl=64 time=0.393 ms
64 bytes from 192.168.1.254: icmp_seq=0 ttl=255 time=2.511 ms (DUP!)
64 bytes from 192.168.1.65: icmp_seq=0 ttl=64 time=5.810 ms (DUP!)
64 bytes from 192.168.1.255: icmp_seq=0 ttl=64 time=7.886 ms (DUP!)
64 bytes from 192.168.1.241: icmp_seq=1 ttl=64 time=0.312 ms

--- 192.168.1.255 ping statistics ---
2 packets transmitted, 2 packets received, +3 duplicates, 0% packet loss
round-trip min/avg/max/stddev = 0.312/3.382/7.886/3.010 ms

The first and last response will almost always be your local machine. The (DUP!) responses are from other machines (though this example also show some machine responding with the broadcast address itself, which is not terribly useful).

You might also try the all-ones broadcast address:

% ping -i 5 -c 2 255.255.255.255
PING 255.255.255.255 (255.255.255.255): 56 data bytes
64 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.392 ms
64 bytes from 192.168.1.254: icmp_seq=0 ttl=255 time=3.053 ms (DUP!)
64 bytes from 192.168.1.65: icmp_seq=0 ttl=64 time=8.685 ms (DUP!)
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.319 ms

--- 255.255.255.255 ping statistics ---
2 packets transmitted, 2 packets received, +2 duplicates, 0% packet loss
round-trip min/avg/max/stddev = 0.319/3.112/8.685/3.401 ms

This example shows less cruft. All the (DUP!)s are other machines and the local machine is easily identified as 127.0.0.1.

Solution 3:

Your Macs all have hostnames so you shouldn't need to know IP addresses. Instead you'll just use the hostname.

The hostnames are based on whatever name you've given the computer. So if the computer is named "Jon's Mac" the hostname you'll use is something like "jons-mac.local".

$ ssh jons-mac.local

If you don't already know your computers' hostnames then you can find out a computer's hostnames in the sharing preferences on that computer, or you can find out the hostnames of other computers on the network using the dns-sd command. This command uses Bonjour to let you browse network services; you'll only find computers that are actually advertising some network service (which, by and large, are the only ones you care about).

If you want to connect to some computer providing ssh, you can find the available computers using:

dns-sd -B _ssh._tcp .

In general you can search for hosts providing particular services using the service names: http://www.dns-sd.org/ServiceTypes.html

The Bonjour protocol also provides the ability to browse for all services, not just particular ones. You can do this by browsing for the special service _services._dns-sd._udp

dns-sd -B _services._dns-sd._udp .

The question is asking about finding other computers on the network from the command line, but you can also browse dns-sd advertised services in the GUI. For example Terminal.app > New Remote Connection... brings up a window that shows advertised ssh, sftp, ftp, and telnet services.

Solution 4:

You could try using dns-sd in order to perform Bonjour queries on the LAN.