How do I detect iPhone on network?

Question

I am trying to detect if my iPhone is in the same network as my Raspberry Pi. I would like to execute a script when I am at home and my iPhone's presence is registered in my LAN.

It seems that when the phone is in standby not even the iphone-sync port (6207/tcp) is found. "/usr/bin/nmap -n -sT -p62078 [my phone's local IP]" shows no host. I wonder what else I could scan for. Obviously the phone is online and ready to accept facetime calls (data via 3G is deactivated). Could I accomplish something with avahi which I am using on my Raspberry Pi, or are there other ways.

Greegree

I have given up on this and am now using bluetooth to check regularly if my iPhone is in range. – Greegree

In case somebody comes across this and is wondering what I do to detect the presence using bluetooth: I try to resolve the name of my (known) device address (sudo hcitool name xx:xx:xx:xx:xx:xx). If I get a valid response, the phone is in BT range. – Greegree

Answer 1

I've just spent a week beating on this problem so I can refrain from sending SMS home alarms to my wife when she's at work.

Pinging won't work because the iPhone won't respond to ICMP when asleep. Reading the ARP cache won't work because a sleeping iPhone will come and go (check it every 30 seconds for a few minutes).

The only way I have found to 'reliably' determine when my two iPhones are on my local (home) network is to use the PCAP dotnet library to look for any packets originating from either of the phones' MAC addresses. For example, if you run Wireshark with the capture filter

ether src <iphone-mac-address>

you will see a surprising amount of network discovery/announcement traffic from the phone. It still has quiescent states, but so far the longest interval I have seen between captured packets is around 10 minutes. You would have to wait until you have not heard from the phone for some interval (I use 15 minutes) before declaring it not-home.

With this technique you will find a phone quickly when it rejoins the home network, assuming your phone is configured for DHCP. I also use port mirroring on my main Ethernet switch to include traffic from my wireless access points.

I don't have a Raspberry Pi solution for this, because my linux expertise is very limited, but someone else may be able to help you along those lines. I have a Windows Service using the PCAP library and so far it works reliably, with the limitation of waiting 15 minutes before deciding an iPhone has left the network.

* update 2-3-2018 *

I have this detection algorithm down to about 5 minutes, using a combination of ping/arp messages directed to each phone, about once per minute. Seems to work great.

Reich

Answer 2

You can find a list of devices on your network by investigating your arp cache.

arp -a

Simply write a bash script to run arp -a at a regular interval, and search for the mac address of your phone.

You could go even further with this and perform different actions depending on what brand of device is connected.

The first 3 hexadecimal digits of a mac address are the vendor id.

Take the following mac address:

00:19:E3:AB:CD:EF

00:19:E3: is one of the registered mac address for apple devices.

By comparing the devices on your network with this list, you could detect when for example a '3com' device, or a 'dell' device attaches to your network.

http://www.coffer.com/mac_find/?string=apple

Brinkmanship

Thanks for the tip. Regrettably iPhones go into some kind of deep sleep mode when they're not used. The arp cache doesn't show any of my four iDevices. – Greegree

Answer 3

You can do "arp-scan -l -r10" for that (tested this myself), but the problem is if mobile data enabled the iphone will go and suspend wifi if screen is locked to safe battery. so you need to disable mobile data .. then arp-scan will work.

Coraleecoralie

Do you know how often iPhone connets to WiFi while locked? I am thinking about presence detection of people in building and it sohuld not be problem, if there will be accuracy about half hour. – Yeast

See my half-a***d answer below. Locked/sleeping iPhones send a considerable amount of low-layer network traffic, which can give you a resolution accuracy of ~20 minutes – Reich