Skip to content
English
  • There are no suggestions because the search field is empty.

How to Find a Device's IP Address Using Wireshark and ARP Filter

A Quick Guide to Determining a Devices IP Address Using Wireshark and the ARP Filter

Introduction:

Have you ever needed to find the IP address of a device on your network, but it seemed elusive? Whether you're configuring a new device, troubleshooting network issues, or simply curious about the devices connected to your network, knowing their IP addresses is essential. In this guide, we'll walk you through a straightforward method using Wireshark, a popular network protocol analyzer. The magic lies in the "Arp" filter, a powerful tool for identifying devices on your network, regardless of your laptop's IP address. Let's get started.

After you learn how Wireshark works you'll understand why you should treat public wifi connections like public bathrooms - Only use in emergencies.

How to Find a Device's IP Address Using Wireshark and ARP Filter:

  1. Install Wireshark: If you haven't already, download and install Wireshark from the official website (https://www.wireshark.org/). Wireshark is available for Windows, macOS, and Linux.

  2. Launch Wireshark: Open Wireshark on your computer. You might need administrative privileges to capture network traffic, so ensure you run it as an administrator if prompted.

  3. Select the Correct Network Interface: In the top menu, go to "Capture" and choose "Options." Here, select the network interface connected to the same network segment as the device whose IP address you want to find. Click "Start" to begin capturing network traffic.

    Wireshark1

  4. Start the Device Discovery & Use the ARP Filter: In the Wireshark main window, you'll see a real-time list of captured packets. At the top, you'll find a "Display Filter" bar. Type "arp" (without quotes) into this filter box and press Enter. Wireshark will now display only ARP (Address Resolution Protocol) packets.

    Wire

  5. Locate the ARP Request: Look for an ARP packet that's an "ARP Request." This packet will typically be a broadcast packet sent out by your device, asking for the MAC address associated with an IP address.

  6. Identify the Target Device: In this ARP Request packet, you'll find information about the device you're interested in. Look for the "Source" IP address, which is usually the device's current IP address. Note this IP address; it's the one you've been searching for.

  7. Stop Capturing: Once you've identified the IP address, you can stop capturing packets in Wireshark. Go to "Capture" in the top menu and click "Stop."

When trying to find the device you're connected to typically the device's manufacturer name will appear in the Source column.

 

Now that you've discovered the IP address of your target device, you can use it for various purposes like network configuration, troubleshooting, or accessing specific services. This method works regardless of your laptop's IP address, making it a versatile and handy tool for network administrators and enthusiasts alike.

If you're using this method to now program a protocol conversion device (TCP/IP to RS-485). Now if when you would want to change your laptops IP address to the same sub domain as the devices you are connected to.