Automatically detect a new computer connected to the network

Is there an elegant way to make a prog开发者_开发问答ram detect a new computer that is connected to the network?

I would like my program to "auto-sense" a new computer being connected on the network (they're on the same network). Like a USB device being connected to the computer.

What I'm doing now is to save a list of all computers in the network from time to time. Another approach is to PING all available IPs on the subnet.

Are there any other elegant approaches?

Thanks!

Listening for ARP requests is the canonical way to do this. Independent of DHCP or not, any connected computer that wishes to communicate with the outside world will have to make an ARP request for the address of the default router. This request will go out as a broadcast, and contain the source interface's MAC and IP adresses.

If the other computer uses DHCP, it will make an ARP request for it's own address as part of duplicate address detection, which is also a broadcast you can snoop on.

(This works more or less the same way for IPv6, except you need to look for neighbor discovery or router soliciation packets instead.)

Like the answer alluded to, if you have a switch to which you can telnet or use SNMP on, you can extract the MAC table. That will give you a list of MAC adresses on each port in the switch. If you want the IP addresses however, you still need to listen for ARP:s.

On the other hand, if you have access to the default gateway on the network, you can also look at the ARP table there. That will give you MAC and IP addresses for anyone that has recently (for different values of recently...) communicated with it.

If you have a managed switch of some kind, you could probably connect to that, that would be a fairly elegant method.

If you're on a domain, you can can get a list of all the machines joined to the domain from the domain controller.

Failing that, all I can think of is either a challenge/response thing (e.g. pinging them) or by detecting traffic sent from them (see this question maybe as a starting point?), neither of which strike me as an elegant approach.