Controlling my light bulbs
from the local network

Connect the Kali VM to my home network

I used Kali Linux, a Linux operating system with security testing tools, inside a virtual machine (VM) on my Windows computer. The targets were two LIFX smart bulbs I own. These are IoT (Internet of Things) devices: everyday objects with network connections.

I checked ipconfig in Windows and ip a in Kali. My home network was 10.0.0.0/24; the /24 describes its subnet size. Kali’s address was 10.0.0.209.

The VM used bridged networking, which placed it on the home LAN, or local area network, alongside the bulbs. This mattered because the discovery method sends messages to the local network. A typical VM’s NAT (network address translation) mode uses a separate virtual network, which can prevent that broadcast discovery from reaching the home LAN. VM networking reference ↗

Learning point: check the adapter mode and subnet before troubleshooting a scan. Matching address ranges alone do not prove that every device is reachable.

Find the bulbs with Nmap

Nmap is a tool for discovering reachable devices and checking their network services. From Kali, I ran host discovery on my own subnet:

sudo nmap -sn 10.0.0.0/24

-sn finds responding hosts without scanning their ports. Two results had the vendor label Lifi Labs Management, which pointed me toward the bulbs. Nmap can infer a vendor from a device’s MAC address, its local network interface identifier.

Remember: a vendor label is a useful clue. I confirmed the devices later through their LIFX names and behavior. Discovery can also miss devices that do not respond. Nmap host discovery ↗

Check TCP and understand the limit

I scanned 10.0.0.7, the left lamp’s address:

sudo nmap -sV -sC -p- 10.0.0.7

-p- covers ports 1–65535, -sV attempts service identification, and -sC runs Nmap’s default scripts. The recorded result was all TCP ports closed.

TCP and UDP are different ways of carrying network traffic. TCP establishes a connection; UDP sends messages without that connection setup. This command checked TCP, so it did not answer whether a UDP service was available.

Learning point: the result described the TCP scan. It was not enough to conclude that the bulb had no accessible services.

Try the protocol LIFX actually uses

I learned that LIFX’s local control protocol uses UDP port 56700. A protocol is the set of rules for formatting and exchanging messages. The vendor documentation confirms the transport and port used for these messages. LIFX LAN protocol ↗

sudo nmap -sU -sV -p 56700 10.0.0.7

-sU selects UDP. The result was 56700/udp open|filtered: Nmap could not tell whether a service was listening quietly or a filter was blocking traffic. The result alone did not explain the silence. Nmap’s UDP result meanings ↗

Next step: send a correctly formatted LIFX request and look for a response.

Discover the lamps with the LIFX library

I installed lifxlan, a community Python library that creates messages using the LIFX LAN protocol. A library is reusable code; this one let me communicate with the bulbs without building the packets myself. lifxlan project ↗

I used LifxLAN().get_devices() to discover devices, then requested their labels, addresses, and power states. My notes recorded Desk Lamp Left at 10.0.0.7 and Desk Lamp Right at 10.0.0.147. These requests required no LIFX account token or device password.

python3 -m venv .venv
source .venv/bin/activate
python -m pip install lifxlan

Test power and color changes

I selected Desk Lamp Left by its label and used set_power() to turn it on, wait two seconds, then turn it off. I also used set_color() to cycle through red, green, and blue, one second apart.

The lamp visibly changed as requested. That was the evidence of control: discovery showed that the bulb responded, while the power and color tests showed that it accepted changes.

from lifxlan import LifxLAN
import time

devices = LifxLAN().get_devices()
lamp = next(d for d in devices
            if d.get_label() == "Desk Lamp Left")

lamp.set_power(True)
time.sleep(2)
lamp.set_power(False)