Checking if mac-address is present on network still doesn't work (ping -b and arp)

This is kind of a follow up to this post of mine.

I have the mac-address of my phone (samsung galaxy S9; though it shouldn't matter). I want to check if it's on the network or not. It doesn't have a static ip, so I need to check it using it's mac-address.

I'll refer to the mac-address of my phone with [1].

• On my phone, random mac-address for the network is turned off (this wasn't the case in that previous post). It used to generate a random mac-address every time it connected to my network, now it doesn't.
• This is what I do to check if the mac-address is on the network:

  ping -b 192.168.2.255 -c 20
  arp | grep -i "[1]"
  

This is the "log" of the events:

#phone connected to network
ping -b 192.168.2.255 -c 20 &> /dev/null
arp | grep -i "[1]"
-> successful

#phone NOT connected to network (turned of wifi on phone)
ping -b 192.168.2.255 -c 20 &> /dev/null
arp | grep -i "[1]"
-> successful

The second time, it shouldn't be successful. The phone isn't connected to the network, but it still shows it in the arp output.

My phone doesn't have a static ip-address, but when connecting it to the network, it almost always gets the same ip-address. That's fine. The ping -b output has always been correct. When my phone is connected to the network, I see the ip-address that it almost always gets in the list (of the ping command). When my phone isn't connected, I never see it's "standard" ip-address in the output. So ping works and is "up-to-date".

So I assume that arp isn't "up-to-date" as ping is (but this is just my raw guess). I think that arp doesn't update it's table eventhough ping has "made" a new one. But that is what I think based on a comment of the previous post: "You are already doing a broadcast ping, ping -b 192.168.2.255. This should refill the arp table for any online devices with ip address 192.168.2..*"

Help!

If you are using ARP table to determine whether your phone connected to network or not, you have to remove your phone's ARP entry from your computer's ARP table. Otherwise you won't be able to determine change, because previous entry remains still.

You can remove specific ARP entry with arp -d <IP_ADDR> command, and remove all entries with sudo ip neigh flush all.

But, I think you should use nmap for scanning, besides you won't need to clean ARP table anymore. You can use this script.

#!/bin/bash

mac="$1"
# Scanning network, and obtaining IP address of specfied MAC address, if exists.
PHONEIP=$(sudo  nmap -sP -n 192.168.2.0/24 | grep -B2 "$mac" | grep -Eoi "192\.168\.2\.[0-9]+")
if [[ $PHONEIP == "" ]];then
    echo "$MAC not found."
else
    echo "$MAC found at $PHONEIP"
fi

But you have to give your Phone's MAC address as first argument, or you can change the line mac="$1" to mac="<your-phone-mac>".

Note: You will need super user privileges to use this script.