Network Scanner

[kw123]

please try this version: https://github.com/kw123/Network-Scanne ... /2026.5.58

and set the offline threshold in phone device edit to 3 minutes.

[Japple55]

Okay, just loaded .58 and set the Offline to 3 minutes. So far (1 hour) my phone and the H/A scanner have remained on, but my wife and her phone are away at the moment.

Testing on .56 was a mixed bag. My iPhone 13 was quite active keeping the H/A scanner on, but my wife's iPhone 14 spent most of the time off (per the scanner). Overnight, the H/A had us away several times, even with delay set at 90 seconds. This morning, they were both being seen and working before we left for the gym. On return, the 13 was seen for a while but the 14 wasn't. Then the H/A scanner (and phones) just seemed to go dead (off) for about 30 minutes, no longer seeing the 13 even though I was using it. I looked at the plugin.log and saw some successful pings to both phones, even though the scanner showed them off. When my wife left again, it saw her phone and then started working again. Not sure what happened there.

I think my biggest problem is going to be the 14's limited activity. With only one phone (13) triggering the H/A condition the majority of the time, I don't think it's going to work for my use case. Or, is it possible the activity could be the same, but it's just not being reflected in the scanner/plugin? Perhaps your new version will fix that...I'll report back.

[kw123]

give me a day. I am working on it, I am in Vienna, EU time zone, will have something ready my evening tomorrow.

[kw123]

ok here the last version before I go to bed;

https://github.com/kw123/Network-Scanne ... /2026.5.73

reload,
the open terminal and do
tail -f '/Library/Application Support/Perceptive Automation/Indigo 2025.2/Logs/com.karlwachs.networkscanner/plugin.log'

that should give you something like this:

Code: Select all

026-07-29 00:32:10  _sniff_loop started  iface=en0  sudo=yes
2026-07-29 00:32:10  traffic sniffer (tcpdump) started on en0
2026-07-29 00:32:10  tcpdump launch: echo *** | sudo -S /usr/sbin/tcpdump -i en0 -n -e -l 'arp or (udp port 5353) or (udp port 67) or (udp port 68)'
2026-07-29 00:32:10  DHCP passive sniffer started.
2026-07-29 00:32:10  mDNS browse loop started.
2026-07-29 00:32:10  Device scan loop started.
2026-07-29 00:32:10  Offline watchdog started.
2026-07-29 00:32:10  Network Scanner active
2026-07-29 00:32:14  Net_5C:AD:BA:1B:DB:66  iphone1xprokarl raw traffic [en0]: 00:32:14.513883 5c:ad:ba:1b:db:66 > 1c:f6:4c:5a:5d:39, ethertype ARP (0x0806), length 60: Reply 192.168.1.85 is-at 5c:ad:ba:1b:db:66, length 46
2026-07-29 00:32:14  Net_5C:AD:BA:1B:DB:66  iphone1xprokarl detected:  5c:ad:ba:1b:db:66  IP=192.168.1.85  vendor=Apple  via traffic observed (tcpdump)
2026-07-29 00:32:55  startup finished, offline ignore period ended
2026-07-29 00:33:36  Net_5C:AD:BA:1B:DB:66  iphone1xprokarl detected:  5c:ad:ba:1b:db:66  IP=192.168.1.85  vendor=Apple  via sweep (arp)
2026-07-29 00:35:17  Net_5C:AD:BA:1B:DB:66  iphone1xprokarl raw traffic [en0]: 00:35:17.604603 5c:ad:ba:1b:db:66 > 1c:f6:4c:5a:5d:39, ethertype ARP (0x0806), length 60: Reply 192.168.1.85 is-at 5c:ad:ba:1b:db:66, length 46
2026-07-29 00:35:17  Net_5C:AD:BA:1B:DB:66  iphone1xprokarl detected:  5c:ad:ba:1b:db:66  IP=192.168.1.85  vendor=Apple  via traffic observed (tcpdump)
2026-07-29 00:36:57  Net_5C:AD:BA:1B:DB:66  iphone1xprokarl raw traffic [en0]: 00:36:57.750850 5c:ad:ba:1b:db:66 > 1c:f6:4c:5a:5d:39, ethertype ARP (0x0806), length 60: Reply 192.168.1.85 is-at 5c:ad:ba:1b:db:66, length 46
2026-07-29 00:36:57  Net_5C:AD:BA:1B:DB:66  iphone1xprokarl detected:  5c:ad:ba:1b:db:66  IP=192.168.1.85  vendor=Apple  via traffic observed (tcpdump)
2026-07-29 00:38:38  Net_5C:AD:BA:1B:DB:66  iphone1xprokarl raw traffic [en0]: 00:38:38.511389 5c:ad:ba:1b:db:66 > 1c:f6:4c:5a:5d:39, ethertype ARP (0x0806), length 60: Reply 192.168.1.85 is-at 5c:ad:ba:1b:db:66, length 46
2026-07-29 00:38:38  Net_5C:AD:BA:1B:DB:66  iphone1xprokarl detected:  5c:ad:ba:1b:db:66  IP=192.168.1.85  vendor=Apple  via traffic observed (tcpdump)
2026-07-29 00:40:17  Net_5C:AD:BA:1B:DB:66  iphone1xprokarl raw traffic [en0]: 00:40:17.763464 5c:ad:ba:1b:db:66 > 1c:f6:4c:5a:5d:39, ethertype ARP (0x0806), length 60: Reply 192.168.1.85 is-at 5c:ad:ba:1b:db:66, length 46
2026-07-29 00:40:17  Net_5C:AD:BA:1B:DB:66  iphone1xprokarl detected:  5c:ad:ba:1b:db:66  IP=192.168.1.85  vendor=Apple  via traffic observed (tcpdump)

and off line / down and back online , when it is back up.

I would need those lines.

Karl
see you tomorrow (= today actually)

[kw123]

https://github.com/kw123/Network-Scanne ... /2026.5.80

all my iPhones stayed up over night with threshold setting to 3 minutes,
and switched to off when wifi was turn off or when I left the house after ~ 3 minutes.

also added some more states to the devices (last on last off etc.)

this should work ok now

could you test?

Karl

[Japple55]

Thanks, Karl. I installed the update yesterday and ran it overnight with device delay set to 3 minutes. From the event log, it looks like the iPhone 13 never went off but the iPhone 14 recorded 14 occurrences of being off for over 3 minutes, the longest of which was 13 minutes.

I'm sorry but I don't understand what you're requesting in terms of the log from the Terminal.

[kw123]

I have 3 iPhones: 12, 16 , 17 all behave well = stay on over night

re the logging:
edit the indigo phone device that does not stay on:
at the bottom check the Log every.

Screenshot 2026-07-30 at 16.19.05.png (33.27 KiB) Viewed 98 times

save

the open a terminal session on the indigo Mac and paste:

Code: Select all

tail -f '/Library/Application Support/Perceptive Automation/Indigo 2025.2/Logs/com.karlwachs.networkscanner/plugin.log'

click on select and paste the string into the terminal window

you should see some entries there like:

Code: Select all

2026-07-29 00:32:14  Net_5C:AD:BA:1B:DB:66  iphone1xprokarl detected:  5c:ad:ba:1b:db:66  IP=192.168.1.85  vendor=Apple  via traffic observed (tcpdump)
2026-07-29 00:32:55  startup finished, offline ignore period ended
2026-07-29 00:33:36  Net_5C:AD:BA:1B:DB:66  iphone1xprokarl detected:  5c:ad:ba:1b:db:66  IP=192.168.1.85  vendor=Apple  via sweep (arp)
2026-07-29 00:35:17  Net_5C:AD:BA:1B:DB:66  iphone1xprokarl raw traffic [en0]: 00:35:17.604603 5c:ad:ba:1b:db:66 > 1c:f6:4c:5a:5d:39, ethertype ARP (0x0806), length 60: Reply 192.168.1.85 is-at 5c:ad:ba:1b:db:66, length 46
2026-07-29 00:35:17  Net_5C:AD:BA:1B:DB:66  iphone1xprokarl detected:  5c:ad:ba:1b:db:66  IP=192.168.1.85  vendor=Apple  via traffic observed (tcpdump)
...

after the iPhone went down and up please copy the lines and post the lines from around that time here or email to karlwachs at me com


Karl