Thought I would try out this nirsoft.net “who is connected utility” from www.nirsoft.net. I am a big fan of nirsoft because their utilities are specific, small, portable, no ads and support is responsive.
From the readme file
“WhoIsConnectedSniffer (https://www.nirsoft.net/utils/who_is_connected_sniffer.html) is a network discovery tool that listens to network packets on your network adapter using a capture driver (WinpCap or MS network monitor) and accumulates a list of computer and devices currently connected to your network. WhoIsConnectedSniffer uses various protocols to detect the computers connected to your network, including ARP, UDP, DHCP, mDNS, and BROWSER.
For every detected computer or device, the following information is displayed: (Some of the fields might be empty if the information cannot be found inside the packets) IP Address, MAC Address, name of the device/computer, description, Operating System, Network Adapter Company, IPv6 Address.
After collecting the connected computers/devices information, you can easily export the list to tab-delimited/comma-delimited/xml/html file.”
I wanted to see if the software truly listens or if it queries devices to determine more information. So I configured Wireshark with an IP address of a random device – a wireless router acting as an access point and was surprised to see that it send out a Browser Announcement and SMB Domain Enumeration. Why would it do this when I have no storage installed and no protocols configured?
Comments