Is it possible to detect Android and iOS devices based on DHCP requests?

Question

I want to configure DHCP server in a way that it puts "regular" smartphones and tablets into a separate subnet. Is it possible to detect if the DHCP request comes from an Android or iOS device based on the DHCP request itself?

For example: a Sony android phone which was around set the following DHCP options in request, which are potentially useful for identification

bootp.option.vendor_class_id == "dhcpcd-5.2.10:Linux-2.6.32.9-perf:armv7l:mogami"
bootp.option.hostname == "android-c7d342d011ea6419"

Are there any known common patterns in SmartPhone DHCP requests that are better than MAC prefix?

score 1 · Accepted Answer · answered Oct 22 '12 at 15:04

An Android phone here sent similar vendor ID:

Option: (t=60,l=52) Vendor class identifier = "dhcpcd-5.2.10:Linux-3.0.16-ge733189:armv7l:shooter_u"

However an iPhone device sent nothing beyond its MAC address and hostname. The same was true of a Nokia Symbian device (E71). My sample of three devices suggests that only Android devices send anything useful. You might have some success by finding what information each client requests (SIP server, domain search) and indeed does not request, and using that as a 'fingerprint'.

To my mind, however, the real answer is to put 'unknown' clients in a default network, and explicitly known devices in a different one.

score 1 · Answer 2 · answered Apr 28 '15 at 23:45

Using the host-name to match. Users could change it, on Android, Settings > Developer Options > Device host-name. But I am pretty sure that 90% of you users leave that setting alone. iPhone and iPad

class "Android" {
  match if substring(option host-name,0,7) = "Android";
}
class "iPhone" {
  match if substring(option host-name,0,6) = "iPhone";
}
class "iPad" {
  match if substring(option host-name,0,4) = "iPad";
}
class "Windows-Phone" {
  match if substring(option host-name,0,13) = "Windows-Phone";
}
class "BLACKBERRY" {
  match if substring(option host-name,0,10) = "BLACKBERRY";
}

score 0 · Answer 3 · edited Jan 28 '13 at 10:48

You can limit the network access in your DHCP server. For example, in ISC DHCP, you can define a class or several subclasses using the string that android send:

class "Android" {
  match if substring(option vendor-class-identifier,0,5) = "dhcpd";
}

You can register this information for debugging in your logs files adding to your cfg file:

log (debug, substring (option vendor-class-identifier, 0, 5));

Is it possible to detect Android and iOS devices based on DHCP requests?

3 Answers3