3 ms·
One curious thing about the What's My IP Address? page (the only one I looked at) -- it also detected 4 other devices on my network (192.168.xx.xx, 10.0.xx.xx,
by ksherlock 4y ago
One curious thing about the What's My IP Address? page (the only one I looked at) -- it also detected 4 other devices on my network (192.168.xx.xx, 10.0.xx.xx, etc). But how?
Well, there's a list of 92 ip addresses (iplist -- it's a slightly weird list but I suppose it's based on common router and cable modem addresses). For each one, it runs an XmlHTTPRequest(). But none of the detected IP addresses are running web servers, you say. No matter. Most TCP stacks will send a TCP reset if there's nothing listening on the port (this can often be disabled with the proper incantation) which will result in an onerror callback and therefore there is a device If there is no device (or TCP reset is disabled) it will eventually result in the ontimeout callback. And of course, if there is a web server running, the success callback will trigger. So success or an failure indicates a device on your network.
- wlonkly 4y agoI'm mildly surprised this is allowed by browsers, but I can't think of an easy way to prevent it, either. (That said, were I the tool author, once I found any hit, I would then scan the whole /24 that the hit was in. But then I'd be here being more than mildly surprised.) It is indeed a weird list[1]. [1] https://gist.github.com/wlonkly/b39f8fe37c8455bcc0bce6a7549a62ee https://gist.github.com/wlonkly/b39f8fe37c8455bcc0bce6a7549a...