Currently, I attempt to retrieve all the IP address that are assigned to your machine, and then go through each octet making a broadcast on each subnet (255.255.255.255, 192.255.255.255, 192.168.255.255, 192.168.1.255, etc).

FWIW, it still doesn't work in all scenarios. My server running FreeBSD with 2 NICs can never find the empeg. But that config is pretty funky, the 'outside' NIC has a static bogus address (192.168.0.1) and a dynamically assigned real address doing PPPoE. The inner interface has another static non-routable address (192.168.101.254). There is also a virtual interface used for a VPN with a third non-routable IP. So four IP's total several of which have firewall rules applied to them and two of which are doing NAT just to make it a little more complicated. All the all the netmasks are .255s though so your search routine should work AFAIK. I have been meaning to ask you for a while if you could add an option to specify a network or at least interface to search.

-Mike