Two, maybe three, possible solutions that I know of:
Option 1: Ping the broadcast address, then read the ARP table
This assume you can't run any special code on the remote device you are trying to discover the IP address for, but it does have an ICMP stack that is enbled. (i.e. you can ping it)
Assuming this device supports ICMP (ping). You can send one or more ICMP ping requests to the broadcast address of your subnet and listen for responses back from all devices on the subnet. Then consult the local ARP table to see which device messages you back. You can try this from the command line of any computer. Let's say your local ip is 192.168.1.2
and your subnet mask is 255.255.255.0
. It follows that your subnet's broadcast IP is 192.168.1.255
. Therefore you can do this at the command prompt (Linux, Windows, Mac)
$> ping 192.168.1.255 // let this run for a few seconds, then cancel after it retries a few times
$> arp -a // this will dump the local ARP table of every MAC to IP mapping discovered and cached
It would take a little work to write the equivalent Android code to do this, but it should be possible. You may need to use the NDK to get to the lower level socket functions to read the arp table. You might be able to get the source ethernet via recvmsg
.
Option 2: UDP broadcast.
This assumes you can run some sort of code on the remote device that it can respond to. It just listens on a designated port (e.g. UDP port 29999). Similar to above, the finder Android device just sends a broadcast UDP message to the broadcast address of the subnet mask. The payload of this message is just your own protocol to ask "who has 88-66-aa-6c-d5-c1" ? The device responds with something to the effect of "I have 88-66-aa-6c-d5-c1". The IP comes back as the "from" address in the socket recvfrom call. You could also build it into the protocol payload as well.
Option 3: It's been a while, but here's some hints.
I recall back when I worked on a hardware product with wifi, we were going to do some sort of auto-config protocol where the target device might not even be on the intended wifi, but we wanted to send some sort of message to it. We had experimented with some mix of broadcast UDP to 255.255.255.255 and sending a UDP packet to a multicast address between devices. I think when you broadcast to 255.255.255.255 or use multicast, it hits all devices as long as they are on the same physical segment or share an AP. Some experimentation required. You might be able to combine this approach with either option 1 or 2 above.