I've used Pi's for a couple minor projects but I have been wondering if the following was possible:

I'm hoping to utilize another Pi as part of a larger home automation project but I didn't know if it was feasible for a Raspberry Pi to essentially "listen" for particular devices to join the same local network that it is on?

The Pi is not the DHCP server or router by any means, just another device connected to the network. Can it listen for device names? MAC addresses? Device manufacturers?

For example:

  • Pi is connected to MyLocalNetwork.
  • Bob's Phone comes within range of MyLocalNetwork and joins accordingly.
  • Pi "sees" Bob's Phone and executes some sort of script, web service call, etc.
  • Pi "sees" Bob's Phone drop off of the network and executes something else.
  • Pi "sees" a guest device with Apple as the manufacturer and responds accordingly.

Those are just some basic examples but I'm not aware of anything that passively listens for other devices on the network.

Is something like this possible?


  • 1
    I know that programs like arpwatch exist, but is it possible to customize it so that it either sends customized emails/events?
    – Shawn H.
    Mar 10 '15 at 2:48
  • 1
    avahi is a zeroconf protocol which allows device discovery. I don't know if it enables notification of connected/disconnected devices. I use netatalk (which uses avahi) on my Pis. It lets you use SHARENAME.local to get the IP of an available device e.g. ping raspberrypi.local. You could certainly poll for known/expected devices.
    – Milliways
    Mar 10 '15 at 3:24
  • Is this wifi, etherlink or both?
    – Bex
    Mar 10 '15 at 8:06
  • @Bex - I'd like it to be able to recognize certain wifi devices. Connecting the Pi to ethernet would be more reliable but it could sit on wifi also.
    – Shawn H.
    Mar 10 '15 at 12:49

Have a look at the wireshark (GUI based) and the tshark (console) packages.

They both listen to traffic in promiscuous mode.

If they can see the data you are wanting to capture then craft your own version (it's not hard, I have done so myself).

  • Are there any performance issues with having it always listening?
    – Shawn H.
    Mar 10 '15 at 12:51
  • There are bound to be, but from memory they were insignificant for my usage. Looking back at the code it was four years ago and was harder than I remembered.
    – joan
    Mar 10 '15 at 13:30

One way to do it may be to use a packet sniffer to watch for the BOOTP/DHCP request the device makes when it attempts to find a DHCP server. Here's sample output from tcpdump:

08:31:01.505978 IP > BOOTP/DHCP, Request from fd:63:9a:a2:33:16 (oui Unknown), length 314

This doesn't work so well when talking about wired devices connected to a switch, but for a home wireless network it should work just fine.

Also, to identify that as Bob's phone it helps if you already know that the MAC is fd:63:9a:a2:33:16

Arpwatch is probably a better way to do it. It uses the same pcap library that tcpdump does to capture packets, and only looks for ARPs. It logs new MAC/IP pairings, and can be configured to send e-mails. The first time it runs, all pairings are new to it, so you'll probably get reports on several devices.


If it has to do with wifi, then kismet is your very bestest friend indeed. You will be able to see the devices, when they connect, what they connect to, regardless of whether it is your own device or your neighbour's or your neighbour's cat's uncle's wireless necklace.


Since I use my Pi as the router with isc-dhcp-server, I run a script to watch the /var/lib/dhcp/dhcpd.leases file. For IPv6 environments radvd can be monitored, and if your environment have an abundance of Apple devices you can also use avahi-daemon to do this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.