[TriLUG] raspberry pi easily find IP

[Kevin Otte]

Sadly, this does not (yet) work for Raspberry Pi since they do not have 
IPv6 enabled by default. You can, however, "modprobe ipv6" on the Pi and 
it will start using the new protocol. If you are preparing a headless 
device, drop "ipv6" on a single line in /etc/modules. Hopefully now that 
we are post World IPv6 Launch they will reconsider this. Anyway...

If you're looking for a particular machine by MAC address on a segment, 
you can ping the multicast address for all nodes. Any machine with a 
working IPv6 stack should answer back unicast. This is a little more 
polite (and faster!) than doing a full subnet scan in IPv4 space. All 
the node responses will get stored in the neighbor table, which can then 
be searched.

In my example, we will search for a KVM virtual machine:

kjotte at daedalus:~$ ping6 -c1 ff02::1%wlan0 >/dev/null;sleep 1s;ip -6 
neigh | grep 52:54:00
fe80::5054:ff:fe26:4df6 dev wlan0 lladdr 52:54:00:26:4d:f6 DELAY

Breaking it down:

ff02::1 is the important nugget of info here: the All Nodes multicast 
address. When using the link-local addresses, you must specify the 
interface as I have done here with the % separator. You can optionally 
use the -I flag, but the % notation will come in handy later.

"ip -6 neigh" fully expands to "ip -6 neighbor show". The Neighbor 
Discovery Protocol is analogous to ARP in the v4 world, and this command 
shows that table.


The great part about this method is that the device need not even have a 
valid global address in either v4 or v6 in order to reach it. eg:

kjotte at daedalus:~$ ssh fe80::5054:ff:fe26:4df6%wlan0
...
kjotte at fe80::5054:ff:fe26:4df6%wlan0's password:
...
Last login: Sun Dec 16 17:12:58 2012 from 2001:470:8:64f:e004:9364:db39:d6f1
kjotte at avalon:~$

So long as it has a working IPv6 stack, it should be findable.

-- Kevin

On 12/19/2012 02:58 PM, Michael Hrivnak wrote:
> This may be old news, but today I discovered an easy way to spot a
> raspberry pi in a crowd, and perhaps it will be of use to others.
>
> A coworker brought in a headless raspberry pi, connected it to the network,
> and wasn't sure how to determine its IP address. The subnet is quite
> crowded and active, so it wasn't convenient to consult a dhcp server or
> scan with nmap. I thought perhaps we could find the MAC address printed on
> the device and then use ARP. Alas, the address was nowhere to be found.
>
> Thankfully, the Raspberry Pi Foundation has its own MAC address space.
>
> http://hwaddress.com/mac/B827EB-000000.html
>
> So it was easy to find the device and its IP address with arp-scan.
> (addresses changed to protect the guilty)
>
> $ sudo arp-scan --interface=em1 192.168.1.0/24| grep 'b8:27:eb'
> 192.168.1.169 b8:27:eb:88:01:ab (Unknown)
>
> Michael
>