The way you find out NIC addresses is using ARP, or Address Resolution Protocol. It is used by Ethernet network drivers to figure out what the MAC address of a given destination is. You can use ARP to do what you want.

There's two tricks, both UNIX-based. Your system and privileges will affect what you can choose.

The easy way, though it requires "root" level access on a UNIX-type system, is to use 'arping'. You just tell it who you want to ping, and where, and it comes back with an ARP response all broken out for you, such as:    Unicast reply from 24.114.X.X [00:01:64:A5:F9:00]  2.588ms The other way is to just use the off-the-shelf 'ping' program a whole whack of times to stimulate ARP responses from as many remote nodes is required. Remember that there won't be any entries in the ARP table unless the machine your on hasn't had to communicate with anyone. The ARP entries also expire after a period of time, though it is at least a few minutes.

Then you can read the ARP table directly from your system (i.e. /proc/arp) or by using the 'arp' program which will give you something like:

? (10.3.3.10) at 00:E0:29:25:7A:46 [ether] on eth0
? (24.114.X.X) at 00:01:64:A5:F9:00 [ether] on eth1
[download]

Once you've got the MAC address, you can do a few lookups to find out who might have made that gear. Each "vendor" is allocated a unique three-octet beginning, so you can guesstimate what that device is by this data.

The trick is to find a comprehensive table of registrations. The IANA (Internet Assigned Numbers Authority) is supposed to do this, but their material is out of date even though they are the ones who issue numbers. Can you believe they have a "gopher://" URL in that file? Yikes.

The IEEE seems to have a pretty good, parsable file at here. See if that's to your liking.