How to build a device inventory from a PCAP

Devices describe themselves constantly: they announce names, ask for addresses, and identify their software to the servers they talk to. A capture collects all of it without sending a single packet. That makes it a safe way to find out what is really on a network, including the devices no one wrote down.

1. Why passive, and its limits

Active scanning finds devices by probing them, which can upset fragile equipment (industrial controllers, medical devices, old printers) and needs permission. A capture only listens. The trade-off is that it only sees devices that talk during the capture, on the segment where it was taken:

• Capture where the traffic is: on a mirrored switch port or uplink, not on one laptop.
• Capture for long enough. DHCP renewals happen hours apart, and a device that is switched off isn't there at all.
• The richest moment is start-up: devices joining the network announce the most about themselves. A capture across the start of the working day sees most of them.

2. Hardware vendors from MAC addresses

The first half of a MAC address is registered to the manufacturer. Wireshark resolves it:

tshark -r capture.pcapng -T fields -e eth.src -e eth.src_resolved | sort -u

3c:52:82:aa:00:01	HewlettPacka_aa:00:01
f0:18:98:bb:00:02	Apple_bb:00:02

Modern phones and laptops often use a random, private MAC address per network, which resolves to no vendor. You can recognise them: the second hex digit is 2, 6, A or E (the "locally administered" bit). Traffic from beyond the local router carries the router's MAC, so vendor lookups only work for devices on the captured segment.

3. Names and OS hints from DHCP

When a device asks for an address, it usually sends its hostname, a vendor class and a list of the options it wants, in an order fixed by its operating system:

tshark -r capture.pcapng -Y "dhcp.option.dhcp in {1, 3}" \
  -T fields -e dhcp.hw.mac_addr -e dhcp.option.hostname \
  -e dhcp.option.vendor_class_id -e dhcp.option.request_list_item | sort -u

3c:52:82:aa:00:01	FINANCE-PC07	MSFT 5.0	1,3,6,15,31,33,43,44,46,47,119,121,249,252
f0:18:98:bb:00:02	Pixel-8	android-dhcp-14	1,3,6,15,26,28,51,58,59,43,114,108

• Hostname (option 12): often the asset name, or the owner's name on personal devices.
• Vendor class (option 60): MSFT 5.0 for Windows, android-dhcp- plus a version for Android, and device-specific strings for printers and phones.
• Parameter request list (option 55): its order is a good operating-system fingerprint, and public DHCP fingerprint databases can name it. Look it up by hand.

The server's Offer and Ack carry the address the device was given, which links the MAC to its IP for the rest of the capture.

4. Name announcements

Many devices announce their names to the local network:

• mDNS (Apple devices, printers, smart speakers, Linux): mdns && dns.flags.response == 1, with names under .local and the services offered, such as _ipp._tcp for a printer.
• NetBIOS and LLMNR (Windows): nbns.name and llmnr.
• LLDP and CDP (switches, access points, IP phones): lldp.tlv.system.name and cdp.deviceid, often with model and software version.

tshark -r capture.pcapng -Y "mdns && dns.flags.response == 1" \
  -T fields -e ip.src -e dns.resp.name | sort -u

5. Software banners and user agents

• SSH servers and clients announce their software: ssh.protocol shows SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13, which even names the distribution. HASSH fingerprints (ssh.kex.hassh) can catch a client whose banner lies.
• HTTP user agents name the browser and operating system: tshark -r capture.pcapng -Y http.user_agent -T fields -e ip.src -e http.user_agent | sort | uniq -c. The Server header names web server software on embedded devices.
• TLS client fingerprints (JA4) group connections by client software, even when everything is encrypted.
• Windows authentication names the workstation: ntlmssp.auth.hostname in NTLM logons, and Kerberos requests carry the user and computer accounts.

6. Build the table

Join what you found on the MAC address, and on the IP address the device held during the capture: vendor, hostname, operating-system hint, software seen, and the services it offered or used. Then compare it with your asset register. The interesting rows are the devices you can't match: an unknown vendor on the server VLAN, a Raspberry Pi in an office, a personal device on the corporate network, or a server running an SSH version you thought was retired.

Manual method vs PCAPNG Analyzer