How do I detect iPhone on network?

I've just spent a week beating on this problem so I can refrain from sending SMS home alarms to my wife when she's at work.

Pinging won't work because the iPhone won't respond to ICMP when asleep. Reading the ARP cache won't work because a sleeping iPhone will come and go (check it every 30 seconds for a few minutes).

The only way I have found to 'reliably' determine when my two iPhones are on my local (home) network is to use the PCAP dotnet library to look for any packets originating from either of the phones' MAC addresses. For example, if you run Wireshark with the capture filter

ether src <iphone-mac-address>

you will see a surprising amount of network discovery/announcement traffic from the phone. It still has quiescent states, but so far the longest interval I have seen between captured packets is around 10 minutes. You would have to wait until you have not heard from the phone for some interval (I use 15 minutes) before declaring it not-home.

With this technique you will find a phone quickly when it rejoins the home network, assuming your phone is configured for DHCP. I also use port mirroring on my main Ethernet switch to include traffic from my wireless access points.

I don't have a Raspberry Pi solution for this, because my linux expertise is very limited, but someone else may be able to help you along those lines. I have a Windows Service using the PCAP library and so far it works reliably, with the limitation of waiting 15 minutes before deciding an iPhone has left the network.

* update 2-3-2018 *

I have this detection algorithm down to about 5 minutes, using a combination of ping/arp messages directed to each phone, about once per minute. Seems to work great.

You can find a list of devices on your network by investigating your arp cache.

arp -a

Simply write a bash script to run arp -a at a regular interval, and search for the mac address of your phone.

You could go even further with this and perform different actions depending on what brand of device is connected.

The first 3 hexadecimal digits of a mac address are the vendor id.

Take the following mac address:

00:19:E3:AB:CD:EF

00:19:E3: is one of the registered mac address for apple devices.

By comparing the devices on your network with this list, you could detect when for example a '3com' device, or a 'dell' device attaches to your network.

http://www.coffer.com/mac_find/?string=apple

You can do "arp-scan -l -r10" for that (tested this myself), but the problem is if mobile data enabled the iphone will go and suspend wifi if screen is locked to safe battery. so you need to disable mobile data .. then arp-scan will work.