Feb 28, 2012

Fing is a great app to see who is on your network


I have been looking for a simple way to see all the devices on a Local Area Network for a long time. Fing, an application for both Android and iOS, seems to be the answer. It's fast, free and extremely useful.
You might expect to get this information from the router. After all, it sits at the heart of small networks; all devices connect to it and all data flows through it. But, many routers are stingy with information.
My Linksys router, for example, doesn't report anything about devices with static IP addresses. And, even Netgear routers, which do report on all attached devices, provide very little information.   
Recently, I stumbled across an article at SmallCloudBuilder, Cool Android Apps For Network Fun, which said "Overlook Fing is probably the best Android app you can get for your home network." Intrigued, I tried it - and loved it. 
Apple enthusiasts should not be put off by the title as Fing also runs on iOS (I tested version 1.5 on my first generation iPad running iOS v4). That said, Fing on Android (currently at version 1.27.2) seems a bit more polished.  
I tested Fing on both an HTC smartphone running Android 2.3.4 and a Samsung Galaxy Player 4 running version 2.6.35.7. According to the developer, Overlook, it also runs on a Kindle Fire.
The mobile editions appear to be the latest incarnations of Fing. Originally it ran on personal computers under Linux, Mac OS and Windows. I have not looked into Fing on a full-sized computer because, to me, network discovery and monitoring is an application best done on a device that boots up and shuts down in seconds. This allows you to run the app whenver the mood strikes.  
The main feature of Fing is scanning and discovering all the devices on the same network that it's running on. An Android screenshot of this initial display is shown below. A larger version of this display is available here.
The top of the display shows the SSID (a.k.a. network name, "Overlook WiFi" in the example) and the node count. To networking nerds a "node" is a computing device on a network. The "18/20" on the right means that there are currently 18 devices connected to the network and that two devices, that were connected in the past, are not there now.   
The initial screen from my iPad is shown below.
Fing takes advantage of the bigger iPad screen to label the node field. In this example, 9 of 10 are online.  "SSID_Name" is standing in for the name of my network which I crudely erased.
Note that on an iPad the app does not report how old the display is. In the Android example, you can see that the last network scan was run 24 hours ago.
Clicking on the network section at the top of the display brings up details about the network. An Android example is below. 
Fing reports the default gateway (the IP address of the router), the MAC address of the router (BSSID), its public name (such as xxx.dyn.optonline.net or pool-99.cmdnnj.fios.verizon.net), the ISP the router is connected to, and the geographic location of the router (not always accurate). The public name is labeled "Internet address" a poor choice of terms. The "Local address" is the IP address of the device running Fing.
One gripe here is that the Android version only reports a single DNS server IP address, even on a network configured to use multiple DNS servers. Still, that's better than the iOS version which does not report DNS servers at all.  
But, it is the device list, that's the sexy part of the app.
Unlike my router, Fing reports on all connected devices. The device list, which takes only seconds to produce, is a great way to verify that bad guys have not hopped onto your network.
Or, to find good guys using the network that you were not aware of.
Typically WPA and WPA2 encryption are used in Pre-Shared Key (PSK) mode, which means there is one password for the entire network. If someone comes to visit, you tell them the password and they know it forever. Perhaps their friends know it too. Changing the password is a hassle, as is the best solution, upgrading to a router that offers a separate Guest network. Fing is no hassle at all.
IDENTIFYING DEVICES
Each detected device is identified with an icon, two numbers and one or two names.
In the Android example above, the numbers are stacked vertically on the left. 
  
The top number is the IP address with the most relevant digits conveniently highlighted in yellow. The bottom number is the MAC address*, a (presumably) unique number assigned to every Ethernet network adapter, both wired and wireless.

To be clear, a MAC address identifies the hardware used to connect to the network. It's a hardware thing, not an operating system thing. If you take a Windows computer and use a Live CD to boot it to Linux, the MAC address will be the same under both OSs.
On an iPad, Fing displays the MAC address on the far right. Annoyingly, the columns are not labeled. In my screen shot above, they all end with Xs. More on this below.
Back on Android, the two text descriptions of each device are stacked on the right side of the display.  
The gray one on the bottom comes from the MAC address, all of which are logically split in two pieces.
The left half of a MAC address identifies the company that made the hardware, the right half is a unique number within all the Ethernet network adapters from that hardware manufacturer. Fing takes advantage of this to report on who made the networking hardware used by each connected device.
In the example, we can see that the router is from Netgear and the printer is from HP. Way cool.  
On an iPad the Ethernet vendor is displayed just to the left of the MAC address. The reason my MAC addresses all end with Xs is that I turned on a privacy option in Fing. This tells it to show the manufacturer part of the MAC address on the left but not the unique ID part on the right.  
Knowing the company that made the Ethernet network adapter can be very handy when dealing with companies such as Apple, Samsung, Roku, HP and Netgear which seem to make their own stuff. Yes, we all know that Apple iToys are made in China by Foxconn and others, but Apple nonetheless appears as the manufacturer of record for the networking hardware in their devices.  
Not so with Lenovo. Some Lenovo computers have network adapters made by Universal Global Scientific Industrial, while others have networking hardware from Intel.  
For the first couple days I was using Fing, there was a device on my network that I could not identify. The network adapter was made Hon Hai Precision Ind. Co., Ltd which was no help at all. Turned out be a Vonage box, stuck in a corner; out of sight, out of mind. 
 
The other text describing a device on the network is, for lack of a better term, the computer name. In my tests, this was all over the map.

For some Windows computers Fing picked up the network name of the computer. But many devices had no name and who knows how things like a Roku box, a smart TV, a DVD player or an Internet radio name themselves. The Vonage box, I learned the hard way, has no name. For some devices, my router had a name but Fing did not.
Regardless of the initial name, if any, shown by Fing, you can change it to something more useful.
If, for example, a Windows computer has a name that means something to the large corporation that issued it, but means nothing to an outsider, you can assign a Fing name such as "Groucho laptop". Fing, I assume, will map this name to the unique MAC address, so the device will always have the same name even if its IP address changes. The names shown in the screen shot from my iPad were all manually assigned by me.
One wrinkle here has to do with laptops supporting both wired Ethernet and wireless Wi-Fi.
The MAC address uniquely identifies the hardware communicating on the network, not the computer. Thus, a laptop that connects wirelessly on Monday and wired on Tuesday will create two different entries in the Fing inventory. When I tested this on a Samsung netbook, the wired Ethernet network adapter was made by Samsung, and the wireless radio was made by Askey Computer.
But this is not a problem, because we can assign unique names such as "Harpo laptop wireless" or "Harpo laptop wired" to a device in the Fing inventory.
By the time you are done identifying and naming the devices on your network, any intruders will stand out like a sore thumb. That's Defensive Computing.
That said, an intruder that gets on and off your network while Fing is not scanning, will not be detected.
But, Fing does keep track of all the devices that it has ever seen on each network that it analyzes.
Devices that were not online during the most recent scan are grayed out. In the Android screen shot, The Samsung TV and the Sony laptop were off-line. You can optionally configure Fing to put off-line devices at the bottom of the list, which seems like a good idea to me.
If the same device has been seen on the network with multiple IP addresses, this is indicated with a "(+9)" after the current IP address, where 9 is the number of additional IP addresses the device has used. Again in the Android example, the Apple desktop computer near the top of the list has had 4 other IP addresses in addition to its current IP address of 192.168.0.5.
As for the icons, Fing has a default icon and tries to assign icons intelligently when it can. For example, on Android it detected that my router was a router and assigned it a router icon. On iOS however, it did not detect the router as a router.
As with device names, you can manually change the icons for each device. I assume here too, that the icon is mapped to the MAC address and will not change if the IP address changes in the future. The Android example shows a number of different icons.
Although Fing comes with dozens of icons, it had none for my favorite toy, an Internet radio. I emailed the developers about this and someone quickly responded** that there will be a radio icon in the next release. The icon itself is not very important, but this shows that the product is being actively developed, which is important.
And, amazing really, when you consider that not only is Fing free, but there areno ads.via[computerworld]

No comments:

Post a Comment