Connect to a network without DHCP

You might be in some new town or some new school and there is no DHCP, or the DHCP is not responding. But you can physically connect to the network. That happens to me alot. I am now posting for a successful breaking an entry to a free WiFi here in Addis Abeba.

If for some reason you could not get an IP form the network, your computer will fail to connect to the network. For many cases, the network admins leave the IP range to the default values. You know '192.168.1.*'. and as you can guess the subnet mask to '255.255.255.0', and the default getway to the first valid address of the range, i.e '192.168.1.1'.

But some don't leave it that way. Specially if there is some more complicated networking done. So, how in the world do we find the range of IP addresses to guess from. Well if you get some IP addresses in use in the network, then the rest is making your IP address to something that is not used in the network.

Lets begin with finding the IP in use in the network. First we have to connect to the network. To do this we have to assign some random IP. Set a static IP address like the above one to your network interface.
Then Scan for active IP addresses in use in the network you are connected to. To achieve this, we need an ARP scanner in place. What we want to do is scan for packets that are being thrown around in the network. It captures packets and registers their IP and MAC addresses.

Thre are many ARP Scanners to choose from. For my linux enthusiast friends, netdiscover is good one. If you are using Backtrak or Kali linux, I hear it is already packaged with your penetration distro. For other linux users, go over

After installing your ARP scanner, somehow set it to passively listen to packets. To do this with netdiscover, run

sudo netdiscover -i wlan0 -p 

This will start instruct netdiscover to listen for packages without sending any requests. The result is any IP address currently communicating in the local network. It might take a while if there is no active device. My result looks like this one

 
Currently scanning: (passive)   |   Screen View: Unique Hosts                 
                                                                               
 21 Captured ARP Req/Rep packets, from 9 hosts.   Total size: 1260             
 _____________________________________________________________________________
   IP            At MAC Address      Count  Len   MAC Vendor                   
 ----------------------------------------------------------------------------- 
 0.0.0.0         f0:24:75:ad:c0:9e    03    180   Unknown vendor               
 169.254.132.101 f0:24:75:ad:c0:9e    03    180   Unknown vendor               
 10.11.3.54      14:58:d0:39:0d:02    05    300   Unknown vendor               
 0.0.0.0         28:cf:da:57:94:f9    03    180   Unknown vendor               
 169.254.34.169  28:cf:da:57:94:f9    02    120   Unknown vendor               
 10.11.6.42      b8:5a:73:62:b1:ec    02    120   Unknown vendor               
 10.11.6.17      84:db:ac:ad:99:70    01    060   Unknown vendor               
 10.11.6.26      b8:ca:3a:96:8f:82    01    060   Unknown vendor               
 10.15.4.10      64:51:06:26:1f:e6    01    060   Unknown vendor 

From this result I could see a list of valid IP addresses. You can see that most of the IP addresses are from '10.*.*.*' range. So you can start guessing from here.