I am trying to develop an application for network monitoring. A part of this application is to detect "is any wifi router connected to any switches ports".
Basically, I have a mysql database table where I have all the mac addresses of devices(pc,wifi router,..) connected to each switch port(by SNMP). As far I know, first three bytes of mac address (Organizationally Unique Identifier - OUI) represent the vendor/manufacturer of the device. So, I want to make a list of all known vendors who manufacture wifi routers (Linksys,TP-LINK,Netgear,SMC,..) and make a match with the OUI to the mac addresses stored in database.
Q1. Is the solution correct? or what would be the appropriate way to solve this problem.
It would be a great help if any one suggest me what should be the appropriate way.
Thanks in advance
No, this is not an appropriate solution. For example, macOS allows a Macintosh to act as a Wi-Fi router via the Internet Sharing feature, but its Ethernet MAC address will still just have a regular Apple vendor prefix.
As already stated by Gordon Davisson you will be missing "Internet sharing"-constructions, so your results will be incomplete (i.e. False Negatives).
Another source of False Negatives could be wireless routers using NICs from a large generic vendor (think Intel).
Besides that; the OUI will tell you what the device's vendor is, but NOT what kind of device it is. It could, for instance, be a WIRED router, leading to results which are not, in fact, wireless routers (i.e. False Positives).
The big pain in the behind for your problem is that what you are trying to detect; a (wireless) router; shields certain data-traffic from clients behind from means of identification that would aid you in your query.
Is there a way to get a notification when a new Wifi Network has been detected?
I glanced through the Native Wifi API Reference and found the WlanRegisterNotification function but I'm not sure if that includes what i am looking for. The remark does not mention it.
Yes, WlanRegisterNotification is indeed the correct function. You need to do a little digging in the documentation to find exactly what each notification provides, by looking at WLAN_NOTIFICATION_DATA (in the remarks section for WlanRegisterNotification), then WLAN_NOTIFICATION_ACM†. Specifically, you're looking for one of these two notifications:
wlan_notification_acm_network_available Which gives a notification when a connectable network is detected, and you're not currently connected to another network, and there isn't an automatic connection available.
wlan_notification_acm_scan_list_refresh (Windows 8+)
† ACM stands for "auto configuration module"
I have to scan my Infrastructure and find it out the way I should use (WMI, SSH, SNMP, etc.) to discover the device details.
The approach I am following as of now is
Get the availability of device.
Query using WMI (If responding? use this protocol to discover this device)
If the above device does not respond to WMI use another protocol like SSH or SNMP (it's configurable) etc.
Is there any other way of discovery for a mixed environment? Please suggest.
The approach you are taking seems reasonable. Alternatively, you could have some existing software do this for you.
I spend lot of time searching how to determine the current network type such as WIFI, 3G, Ethernet.
But I cannot find any information online in windows platform.
I want to detect the Ethernet network type, but I cannot find any API that can retrieve the network type.
I've find Connection Manager for keyword but there's less information.
Did anyone have any idea?
Please help me...I was blocked by this for 2 weeks.
Thanks.
Look in the registry key HKLM\system\state\connections, there is are entries for each of the possible network types, for instance:
When connected to a wireless network:
[HKLM\system\state\Connections\Network]
Adapters="BCMSDDHD1"
Count=dword:00000001
Descriptions="Business World"
when connected to activesync:
[HKLM\system\state\Connections\Desktop]
Adapters=""
Count=dword:00000001
Descriptions="CurrentDTPTNetwork"
The Count value under HKLM\system\state\connections gives you the total number of active connections.
In HKLM\system\state\Hardware you can find the current power state of the various devices.
There is an API on Windows Mobile that makes it easier to access these values vs. going directly to the registry. See the SystemState class documentation, specifically the ConnectionsNetworkCount and ConnectionsCount properties.
Consider the following setup:
A windows PC with a LAN interface and a WiFi interface (the standard for any new laptop). Each of the interfaces might be connected or disconnected from a network. I need a way to determine which one of the adapters is the one connected to the internet - specifically, in case they are both connected to different networks, one with connection to the internet and one without.
My current solution involves using IPHelper's "GetBestInterface" function and supplying it with the IP address "0.0.0.0".
Do you have any other solutions you might suggest to this problem?
Following some of the answers, let me elaborate:
I need this because I have a product that has to choose which adapter to bind to. I have no way of controlling the setup of the network or the host where the product will run and so I need a solution that is as robust as possible, with as few assumptions as possible.
I need to do this in code, since this is part of a product.
#Chris Upchurch: This makes me dependent on google.com being up (usually not a problem) and on any personal firewall that might be installed to allow pinging.
#Till: Like Steve Moon said, relying on the adapter's address is kind of risky because you make a lot of assumptions on the internal network setup.
#Steve Moon: Looking at the routing table sounds like a good idea, but instead of applying the routing logic myself, I am trying to use "GetBestInterface" as described above. I believe what it should do is exactly what you outlined in your answer, but I am not really sure. The reason I'm reluctant to implement my own "routing logic" is that there's a better chance that I'll get it wrong than if I use a library/API written and tested by more "hard-core" network people.
Technically, there is no "connected to the Internet". The real question is, which interface is routeable to a desired address. Right now, you're querying for the "default route" - the one that applies if no specific route to destination exists. But, you're ignoring any specific routes.
Fortunately, for 99.9% of home users, that'll do the trick. They're not likely to have much of a routing table, and GetBestInterface will automatically prefer wired over wireless - so you should be good. Throw in an override option for the .1% of cases you screw up, and call it a day.
But, for corporate use, you should be using GetBestInterface for a specific destination - otherwise, you'll have issues if someone is on the same LAN as your destination (which means you should take the "internal" interface, not the "external") or has a specific route to your destination (my internal network could peer with your destination's network, for instance).
Then again, I'm not sure what you plan to do with this adapter "connected to the Internet", so it might not be a big deal.
Apparently, in Vista there are new interfaces that enable querying for internet connectivity and more. Take a look at the NLM Interfaces and specifically at INetworkConnection - you can specifically query if the network connection has internet connectivity using the GetConnectivity method.
See also: Network Awareness on Windows Vista
Unfortunately, this is only available on Vista, so for XP I'd have to keep my original heuristic.
I'd look at the routing table. Whichever NIC has an 0.0.0.0 route AND is enabled AND has the lowest metric, is the nic that's currently sending packets to the internet.
So in my case, the top one is the 'internet nic'.
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.0.0.10 10.0.0.51 20
0.0.0.0 0.0.0.0 10.0.0.10 10.0.0.50 25
(much other stuff deleted)
Another alternative is to ping or GetBestInterface 4.2.2.2 - this is an old and venerable DNS server, currently held by GTEI; formerly by Sprint if I remember right.
Start > Run > cmd.exe (this works in XP and Vista): ipconfig /all
This displays all info about the interfaces in your computer. The "public" facing interface should have a public IP address. For starters, it should not be 192.168.x.x or 10.x.x.x :)
running traceroute to some public site will show you. Of course, there may be more than one interface that would get you there.
Look at the routing table? Generally, unless you're routing between the networks in windows (which is possible, but unusual for a client computer these days) the interface that holds the default route is going to have the Internet connection.
Your question didn't detail why or what you're doing this with so I can't provide any specifics. The command line tool "route" may be of some help, but there are probably libraries for whatever programming language you're using to look at the routing table.
You can't rely on the IP address of the interface (e.g., assuming an RFC-1918 address [192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8] isn't the internet) since most sites have some kind of NATed firewall or proxy setup and the "internet" interface is really on a "private" lan that gets you out to the Internet.
UPDATE: Based on your further information, it sounds like you have a decent solution. I'm not so sure about the choice of 0.0.0.0 since that's a boundary case for IP address -- might be OK on your particular mix of platform/language. Sounds (from the API description) like you could just specify an address, so why not some address known to be on the Internet, e.g. the IP address of your web site, or something more random like 65.66.67.68? Just make sure not to pick one of the rfc-1918 addresses, or the localhost range (127.0.0.0/8), or multicast, any other reserved range, and any address that resolves to a .mil or .gov (while it doesn't sound like getbestinterface sends any traffic, it would suck to find out by having the feds break your door down... :)
Looking at the network point of view, either could be routing to the "internet" at any time. If things like spanning tree protocol are enabled on a switch then you may find that what may have been the routing card to begin with may not be anymore.
Ping google.com though each NIC.