37

Is there a way to know who is pinging my PC on my network? Is it possible to monitor all ICMP packets? How can I do that?

edwinksl
  • 23,569
  • 16
  • 74
  • 100
nux
  • 37,371
  • 34
  • 117
  • 131

3 Answers3

46

Yes, that is possible using tcpdump, which is a most powerful and widely used command-line packet sniffer (package analyzer) tool available on Linux.

In the terminal application of the computer you want to monitor :

sudo tcpdump -i ethX icmp and icmp[icmptype]=icmp-echo

Options:

-n avoid a (potentially slow) reverse DNS query
−i interface
icmp[icmptype]=icmp-echo    To print all ICMP packets that are echo requests/replies

The it will start listening on ethX and waiting for arrived packets.

Example : I have 2 pc win7 10.1.1.8 , Ubuntu 10.1.1.57 which will monitor packets arrived :

enter image description here

On ubuntu :

enter image description here

Reference : nixCraft

Sabuncu
  • 103
  • 4
nux
  • 37,371
  • 34
  • 117
  • 131
  • 2
    Small correction: `-n` shows IP instead of *DNS names*, not MAC address. So running with -n avoid a (potentially slow) reverse DNS query. – Rmano Mar 06 '14 at 18:23
  • I used wireless card (wlan0) but no return for me using Ubuntu code. – Satya Prakash Oct 30 '17 at 13:39
6

Good workout @nux I liked it .

I also would like to add my trick I use to find who's pinging me by using avahi tool (can be installed from Synaptic).

When I run in terminal avahi-browse -rat , it automatically compiles full list of connections for example:

hostname = [xxx-xxx.local]
address = [xxx::x:xxx:xxx:xxx:xxx] physical
address = [xx.xx.xxx.xx] ipv4 or ipv6
port = [xxx]
txt = [xxx]

For example , I can always see when my Internet provider is pinging me during my session, when I run this command .

To see everything avahi can do , Run :

avahi-browse --help
nux
  • 37,371
  • 34
  • 117
  • 131
JoKeR
  • 6,894
  • 8
  • 42
  • 64
  • i would like simple solutions without installing any package , but its okay – nux Mar 06 '14 at 12:54
  • yes I agree it depends on everyone's desire but this tool has more functions not only pinging it allows discovering services and hosts etc – JoKeR Mar 06 '14 at 13:00
1

This package must simply be installed (if you don't have it):

sudo apt-get install iptables-persistent

Then add this command to the /etc/iptables/rules.v4 file:

-A INPUT -p icmp --icmp-type echo-request -j LOG --log-prefix "LOG_IPTABLES_PING_REQUEST: "

To check who pings you , just check the log file:

grep 'LOG_IPTABLES_PING_REQUEST: ' /var/log/messages

You can also use a monitoring applications such as Wireshark.

nux
  • 37,371
  • 34
  • 117
  • 131
Maythux
  • 82,867
  • 54
  • 239
  • 271