python script that can discover ubiquiti airOS devices on the network. Equivalence of "Device Discovery Tool".

discover.py

#! /usr/bin/env python
# script for ubnt device discovery

# Usage: python discover.py or ./discover.py

import socket
from contextlib import closing

PORT=40860

def send_probe ():
    """ Send a broadcast probe to port 10001"""
    
    with closing(socket.socket(socket.AF_INET, socket.SOCK_DGRAM)) as ssk:
        ssk.setsockopt (socket.SOL_SOCKET, socket.SO_BROADCAST,1)
        ssk.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
        ssk.bind (('', PORT)) 
        ssk.sendto (b'\x01\x00\x00\00', ('<broadcast>', 10001))

if __name__ == "__main__":
    with closing (socket.socket(socket.AF_INET, socket.SOCK_DGRAM)) as rsk:
        rsk.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
        rsk.settimeout (2)
        rsk.bind (('<broadcast>', PORT))
        send_probe ()

        try:
            while True:
                data, (addr, port) = rsk.recvfrom( 1024 )

                x0000 = data.find (b'\x00\x00')
                x0a00 = data.find (b'\x0a\x00')
                x0b00 = data.find (b'\x0b\x00')
                x0c00 = data.find (b'\x0c\x00')
                x0d00 = data.find (b'\x0d\x00')
                x0e00 = data.find (b'\x0e\x00')
                
                part1 = data[x0000 + 2 :x0a00]
                part2 = data[x0a00 + 2 :x0b00]
                part3 = data[x0b00 + 2 :x0c00]
                part4 = data[x0c00 + 2 :x0d00]
                part5 = data[x0d00 + 2 :x0e00]

                start = part1.find (b'\x02\00') + 2 + 1 # skip 1 bit size
                hwaddr = ":".join ([x.encode ('hex') for x in part1[start: start+6 ]])
                ipaddr = socket.inet_ntoa (part1[start + 6: start + 6 + 4])

                boardname = part3[1:] # first bit is size
                shortname = part4[1:]
                network = part5[1:]
                
                print "%(ipaddr)-15s (%(hwaddr)15s) is a %(boardname)10s device in %(network)s." %locals()
                
        except socket.timeout:
            pass

There's a problem with Rocket M5 GPS units that has 2 occurences of 0a00 in part1. using x0a00 = data.rfind (b'\x0a\x00') fixes this.