Find a device in the LAN with a Windows command (1/2)

　I sometimes want to find all the connected PCs on my home network.You can find it from the Explorer network, but it is troublesome to enter if you want to process it with a script.In such a case, the GET-Netneightbor command of PowerShell can be used.

PowerShell's Get-NetNeighbor command can output the IP address obtained by communication within the network.However, because of the large amount of output, it is necessary to eliminate unnecessary items.

Find an accessible IP address on get-netneightbor

　Finding a network node in the LAN is a troublesome process.For example, in class C private networks, the number of nodes is at most 254, so it is not impossible to execute the ping command for all addresses and confirm the existence of the node.However, if you actually write a script, it will be quite troublesome.So it's easy to use the network function built into PowerShell.

　Get-Netneightbor is a command that returns the information on the IP address obtained using ARP.

● Get-netneightbor (Nettcpip) https: // docs.Microsoft.Com/JA-JP/PowerShell/Module/Nettcpip/Get-netneillBor? View = WindowsServer2019-PS

　This command returns an accessible IP address that Windows explores and finds the network.A PC that is connected to the LAN and has a powered power should contain an IP address.However, the IP address returned by GET-NETNEIGHBOR contains most of the "nodes" that are connected to the same LAN, such as printer, routers, and DVD recorders on TV.

　First of all, if you execute the command alone, all network interfaces will be eligible.In Windows 10, virtual machines like WSL2 are also running, so many network interfaces should be connected.

　If you look at the "network connection" displayed in "Network and Internet" → "Change Adapter Settings" in the control panel, there may be many networks (adapters).Get-netneightbor returns all network adapters, so you need to first identify the adapter connected to an.At this time, the index number or name of the interface must be specified.

　A list of network interfaces can be obtained from get-netadapter.

If you select the one that is running with a physical network interface on Get-netadapter (UP), you will find an Ethernet or wireless LAN network interface.

　The "IFindex" property of the object output by this command is specified in the "-interfaceindex" of the get-netneighbor, and the "name" is the interface name specified in "-interfacealias".To eliminate the virtual network interface and display only the operating interface

Get-netadapter -PHYSICAL | HERE-OBJECT {$ _________________________.Status -Eq "Up"} | SELECT -OBJECT NAME, IFINDEX

AndThe interface of Ethernet and wireless LAN should now be displayed.Which one you use depends on which one you use, so please judge it yourself.

　Once the interface number (4 here, 4) is confirmed, start the get-netneightbor as follows.Here, the IP address is limited to IPv4.There should be an IPv6 address, but the story will be complicated, so here we will only talk to IPv4.

By specifying the interface number and IP address conditions, you can ens valid IPv4 addresses in the network with the get-netneighbor command.

Get -netneightbor -interfaceindex 4 -addressfamily IPv4 -state STALE, REACHABLE

　This should enumerate the IPv4 address in the LAN.However, there is a special IP address in the IPv4 address, which needs to be excluded."224.0.0.0-239.255.255.The range of 255 is ignored because it is a multicast address.Similarly 255.255.255.The 255 is a network broad cast address (local broadcast), so it is not assigned to a PC.These are easy to distinguish because the State property is "Permanent".Also, it is possible to ignore the state because it has been determined that it cannot be reached now.

　For this reason, the "-Tate" option is specified for "STALE, REACHABLE".“REACHABLE” means “reachable”, responds to the latest ARP, and has confirmed its existence.Stale changes to a Stale state after 15 to 45 seconds (randomly selected).

　There are points that need to be careful.A PC where both Ethernet and wireless LAN are connected include two IP addresses.Explorers and others determine whether they are the same machine, but GET-NETNEIGHBOR is listed as an individual IP address.

　The other is that if the PC goes into the sleep state and responds to ARP for a certain period of time, it will disappear from the list.For this reason, searching for IP addresses must at least in the target PC is running.