Getting IP address of a direct-connected computer

Question

I’ve connected my working computer with another one using a direct Ethernet cable. The other machine is a desktop computer that has no peripherals (including keyboard, mouse, and monitor) attached and I want to access it using RDP and SMB. The IP addresses are auto-configured, so it gets something in the range 169.254.x.x.

I can wait until Windows recognizes the other machine or scan IP addresses but both take long and unpredictable amount of time. Is there any faster way to recognize the machine on the other end of a direct Ethernet cable? I’ve thought about making a broadcast “Ethernet ping” and reverse ARP but cannot find any instructions for this technique.

Solution 1

At the moment you connect both computers together, they will try to find a DHCP server. After some seconds the request will timeout and the computer will asign a auto-configurated address to itself. The host will then randomly assign itself a link-local ip-address and broadcasts an arp request over the network to see if its in use

The above is a rewritten summary of https://en.wikipedia.org/wiki/Link-local_address

We can use <any> packet capturing tool to capture those packets and print the ip-addresses of those ARP requests.

Capturing arp packets using wireshark GUI (all platforms)

1. Capture on all interfaces: yes (alternatively, select the correct interface if you understand it)
2. Capture filter: arp
3. Start the capture and look for at the right column for the ip addresses of YOUR pc and the OTHER pc

Capturing arp packets using cli tcpdump (Tested on Linux)

1. Start/login to a terminal interface
2. Run the program "sudo tcpdump arp"
3. Ip addresses of YOUR pc and the OTHER pc will show on the screen

Solution 2

A broadcast IP ping might work – not all systems answer to it, but some do when in 169.254 mode. Try ping 169.254.255.255 (needs -b on Linux), or ping ff02::1 (needs ping6 on Linux and possibly a scope such as ff02::1%eth0).

Directly sending a NetBIOS name lookup (using nbtstat -a) might work, if it runs Windows and if you know the computer name. I don't know a LLMNR equivalent.

The 169.254 autoconfiguration involves sending some ARP probes with the host's own address – you can see those in Wireshark, tshark, tcpdump.

---

"Ethernet ping" exists, but only works at Ethernet level, it won't tell you anything about IP. (It's sometimes implemented in the NIC itself, but mostly not implemented at all.)

"Reverse ARP" also exists, but almost never actually implemented either – its primary use was superseded by BOOTP and later DHCP.

Solution 3

If you configure your machine to get an IP Address from a DHCP server, then obviously, there has to be a DHCP server in the network. Given that you use a direct cable (cross) to connect both computers to eachother, there is no DHCP server, so windows creates a fake random IP address. For this reason, it takes a long time to find each other, because there's no server that manages the connection for you.

The best method would be to add a router with DHCP in the mix, as it will speed up things significantly. But if you don't want to spend any money on this, your second best option is to manaully configure the IP Addresses on both machines to 192.168.0.1 and 192.168.0.2 with a subnetmask of 255.255.255.0

Solution 4

If the second machine is completely headless, you'll want to use DHCP of some kind. Either put a router between the two systems whose status screen you can look at, or install a DHCP server application on your working computer to provide the headless system with its address.

Solution 5

You can setup your PC to act as a DHCP server.

http://www.dhcpserver.de/cms/ - Is what I use. It only takes a minute to setup, and works great.

Just give your Ethernet NIC a static IP address (like: 169.254.1.1), and a subnet (like: 255.255.0.0), and nothing else.

Choose the Ethernet NIC as your DHCP server adaptor in the application mentioned previously.

Run the DHCP server application, restart the server or device who's IP you're searching for, and once it's booted up, it'll get served an IP address from the DHCP servers defined range. You can then use the web interface included with the DHCP server to see what IP address the new server has been issued, or simply ping scan all the IPs in the DHCP range.

Quick, easy and intuitive. At least I think so.

View more solutions

Comments

[SK23]

IP ping didn’t work but nbtstat -a <computer_name> -c provides the desired IP address! Thanks!

[kasperd]

There is of course also the "extreme" method of sending ARP requests for all 65024 IP addresses and see which ones you get a reply for.

[Scott - Слава Україні]

The OP already says “I can … scan IP addresses but [this] takes long … amount of time.” in the question.

[Scott - Слава Україні]

The OP says “The other machine has no peripherals attached …” in the question.  I interpret this to mean that it has no keyboard or monitor.

[Scott - Слава Україні]

The OP says “The other machine has no peripherals attached and I want to access it using RDP …” in the question.  I interpret the first part of this to mean that it has no keyboard or monitor, and, clearly, the OP knows about RDP.  And the computer name isn’t a magic bullet — it works only if the first computer “knows” how to map the name to an IP address.  And the whole point of the question is that “The IP addresses are auto-configured,” so the machines don’t know each other’s addresses.

[user1686]

It doesn't if you have good tools. Zmap can scan the entire IPv4 internet in a matter of hours, for example. Doing an ARP scan across 64k addresses can be very fast.