How can I determine the IP addresses allocated by DHCP on a router that I'm connected to?

Question

This “router” is not a typical situation. I’m using my phone as a hotspot and can only configure a select number of DHCP options.

• I can manage the limit on how many devices/clients can use my phone as a hotspot. I have to select from a radio-button list with the options: 2, 3, 4, 5 or 8.

• I can specify the DHCP starting IP address. In this case, it begins at 192.168.6.106.

When I’m connected via Wi-Fi to my phone, an ipconfig /all command shows me that the default gateway is 192.168.6.1 and my IPv4 address is 192.168.1.148. I have the luxury of connecting another device to the phone and that device was assigned 192.168.1.121.

I’ve tried connecting to 192.168.6.1, hoping for some sort of router setup page that I’m used to seeing, but there is no such thing or maybe it's just a matter of incompatable operating systems.

In summary, the “router” (phone) has an IP address of 192.168.6.1 and a DHCP server that begins at 192.168.6.106 and allows up to 8 connections. Normally, I would assume a range of 192.168.6.106 - 192.168.6.113, but connected clients are showing otherwise.

How can I figure out which IP addresses are set aside by DHCP for clients?

Solution

Why would you assume a range of 106 - 113? Just because it only supports up to 8 clients doesn't mean it'll only give out 8 IP addresses. The # of possible devices connected is 1) an option for security and 2) hardware limitations of the networking interface (even dedicated SOHO routers can be found with client limits of 4-10).

The DHCP shouldn’t have limited addresses even though the hardware can’t support it.

It’ll thus assign any valid IP in the subnet, starting from your beginning range. In this case, 192.168.1.106-254. There’s no reason they have to be assigned in order.

Since you’ve given no indication of the IP range being subnetted, it’s safe to assume that the valid addresses are 192.168.1.2-254, with addresses only being eliminated by your starting range.

The reason for this starting range is usually far some arbitrary way of sorting devices. Say you want DHCP for dynamic clients to use the 128-254 range, because you have your certain static devices in the 2-127 range. This way forgoes subnetting, but still lets you know at a glance if you're dealing with a static or dynamic client.

Comments

[Bryan]

You could perform a DHCP exhaustion attack to see what range of addresses / how many it will give. A quick search shows that Backtrack linux and Metasploit support these.

[user234831]

Thanks - I should've known that a program like this existed. Can you post your suggestion as an answer and provide links to this software? If you don't want to go through all the trouble of finding direct links to software that performs this task, please just explain what to look for to find sofware like this. Thanks again.

[Giacomo1968]

@Bryan You should post a fleshed out answer to this.

[Admin]

@OP: you seem to have mixed up subnets: e.g. 192.168.1.148 is not in the same subnet as 192.168.6.106, but these may be typos. The numbers appear (from the few examples) to be assigned randomly. To make this less random, you could start the range at .247 (.255 is reserved). I assume that the limits for simultanious exist due to licensing of third-party software, and 8 are enough for most tethering use cases. An HTTP config server or a more sophisticated DHCP setup would then have cost extra. What is the reason for the question anyway? The clients may not be able to see each other at all (safet