How can I discover the Phillips Hue Wifi lightbulbs on my network with nmap?

Question

Phillips has these instructions (https://developers.meethue.com/develop/get-started-2/) for connecting to/playing with their Hue lights. Apparently, they each host a small server.

I've heard/seen nmap suggested pretty much everywhere for discovering things on the local network (or networks in general). I think this is a great chance to maybe get used to the tool, but everything I've tried is yielding zero results.

I know for a fact there's about 9 lap tops on this network, plus 3 hue lights so surely I'm doing something wrong for there to be zero results.

How can I discover these lights using nmap? Or is it the wrong tool?

Answer 1

I am assuming that you have a Hue bridge for your lightbulbs. If not, let me know and I'll delete my answer

You can actually find the Hue bridge once its connected to your network using the broadcast address of your router & by using nmap and arp. I tried this on my bridge and it seems to work. This is what I did

# Replace 192.168.1.255 with your network broadcast ip
$ nmap -sP 192.168.1.255/24 > /dev/null; sudo arp -na | grep "at 00:17:88"

This will get you the devices that have "Philips Lighting BV" vendor specific MAC segment (This was for my Hue bridge and it's a really old one). Try for the MAC segments based on your bridge and you may be successful with this.

The bridges that are connected to your network will look like this:

? (192.168.1.111) at 0:17:88:9:73:d2 on en0 ifscope [ethernet]

After this you can actually curl the IP above and see if you get access to the web server inbuilt into the bridge.

$ curl 192.168.1.111