How can I find out what machine has what MAC address?? 5

[LedZepRock]

Hi

How can I find out (without walking around every machine) the MAC addresses of its NIC??

Simon

 

[Accessdabbler]

Go to a command prompt (Start > Run > type Command in Win98 or Start > Run > type CMD in Win2K) and use the "ARP -a" command.

 

[LedZepRock]

Thanks

But that only gives me my MAC address, I wish to know all MAC addresses on my network, without going to each machine.

Simon

 

[bfjacobs]

You could ping all the addresses and then go to a command prompt and do an arp -a and that should show you the mac addresses.
(I think that should work)

 

[Bureaucrat]

http://www.everymanonline.com/softwareDevel/

$30

http://www.mjksoft.com/

ListNetIP $14.95

I used to have a Russian freeware program, but haven't been able to find it. If I ever do find it, I'll try to remember to let you know.





I am not here.

 

[lifto]

the machine's hardware address is held in the arp cashe for only a minute aor two. Ping the machine and then do arp -a and you will get it.

HTH

 

[LedZepRock]

Thanks, well that will do it, I was hoping to be able to display all on the local subnet, I will just have to ping um first (think I will use a script)

Thanks
Simon

 

[Bureaucrat]

Here's a freeware program that should do just what you want.

http://www.webattack.com/download/dlnewt.shtml

Let us know if this will work for you.



I am not here.

 

[Bureaucrat]

Just a side note: make sure you uncheck the 'Show Refresh' box in NEWT. It doesn't seem to work with that checked.



I am not here.

 

[LedZepRock]

Ooo now that is perfect, nice one, thanks Bureacrat.

Simon

 

[Bureaucrat]

I found another one that I like a lot:

http://www.webattack.com/get/advancedipscanner.shtml

I am not here.

 

[gbiello]

Here's another idea that doesn't involve additional software. Just ping the broadcast address. For instance if your ip is 192.169.1.x 255.255.255.0, ping 192.168.1.255. That should essentially ping every device on your local subnet, and fill your arp cache. Then just do your 'arp -a'.

-gbiello

 

[kcbell]

gbiello:Wow, indeed it does work. Please explain a little how and why it works. Thanks

 

[gbiello]

Hmmm. How to condense this... The left part of the IP address is the network address. The right part is the node. Exactly what is "The left part" and "The right part" is determined by the subnet mask. A host will respond if the destination IP address is it's own, but will also respond if the node part is all 1's. This represents the broadcast address. Therefore, if you send a ping to the broadcast address, all nodes (should) respond.

 

[kcbell]

Got it! Thanks

 

[Bureaucrat]

Hey gbiello,

I tried it on a very small network and it missed tow machines; the one I pinged from (it was listed as the inerface, but no MAC address) and a 98SE box. It did pickup my router which the software missed. Any idea why it would miss the 98 box?



I am not here.

 

[gbiello]

Not really. I have noticed sometimes IP's get missed, but I haven't had a need to find out if there was any predictability in what get's missed. Sorry.

 

[SgtB]

Here's a quick perl script that'll ping an entire subnet, then print the contents of arp -a to a text file.

For win32 platforms, you'll need to download activeperl from:

http://www.activestate.com/Products/Download/Register.plex?id=ActivePerl

Once installed just copy this code to a textfile, rename it as arp.pl (or whatever). Then from the command prompt type "perl arp.pl" and watch it go.

Edit the script to suite your environment.

This is not desinged to just ping the broadcast address (just in case your subnet is NOT 255.255.255.0)

use strict;
use Win32;
my $subnet = "103.1.5.";  #variable for subnet to ping
my $i = "0";              #variable for last octet
my $dir = "C:/";          #variable for directory output of file
                          #The forward slash is NOT a typo
my $filename = "arp.txt"; #variable for file name
my $output;

while ($i < 255) {
        $i += 1;
        print `ping -n 1 -l 1 -w 2 $subnet$i`;
}
$output = `arp -a`;
open (FILE, &quot;>$dir$filename&quot;);
print FILE $output;                              
print $output;                                   
close (FILE);

Hope this helps! ________________________________________
Check out

http://www.security-forums.com

 

[kcbell]

One of the scenario I know is if the PC has Norton Internet Security or similar software is installed; it will not answer ICMP. That is why you miss those PC.

 

[Gassner]

Hi,

The best way is to look into router arp table. Try using the script below. Needs to install SNMP_util, and you need to put the routers you have in your network, and their community.
Save to iptomac.pl, and use ./iptomac.pl 10.10.10.80

It will search all routers arp tables, and tell the mac of the station, and the equipment it is routed by.

It works here!

#! /usr/bin/perl -w
use strict;
use SNMP_util;
my @devices = ("10.10.10.10","10.10.10.1","10.10.10.20", "10.10.10.23"
my @comu = ("public" ,"public" ,"public" , "public"
my @type = ("router" ,"router" ,"router" , "router"
my $port="161";
my $timeout="100";
my $retries="2";
my $search = $ARGV[0];

for (my $count=0 ; $count <= int(@devices)-1 ; $count++ )
{
#search routers arp table for given address
if($type[$count] eq &quot;router&quot
{
my $community = $comu[$count];
if(&isinrouter($devices[$count], $comu[$count], $search ) eq &quot;1&quot
{
my $mac=&findmac($devices[$count], $comu[$count], $search);
print &quot;MAC is $mac \n&quot;;
}
}
}

sub isinrouter
{
#(router, community, search) returns 1 if found
(my $router, my $community, my $search) = @_;
print &quot;Searching $router\n&quot;;
my @rede=&snmpwalk(&quot;$community\@$router:$port:$timeout:$retries&quot;,&quot;1.3.6.1.2.1.4.22.1.3&quot;
foreach my $ip (@rede)
{
(my $oid, my $ip) = split(/\:/, $ip);
if ($ip eq $search)
{

print &quot;Is in $router\n&quot;;
return 1;
}
}
}

sub findmac
{
#(router, community, search) returns MAC
(my $router, my $community, my $search) = @_;
my @fisico=&snmpwalk(&quot;$community\@$router:$port:$timeout:$retries&quot;,&quot;1.3.6.1.2.1.4.22.1.2&quot;
my @rede=&snmpwalk(&quot;$community\@$router:$port:$timeout:$retries&quot;,&quot;1.3.6.1.2.1.4.22.1.3&quot;
for (my $count=0 ; $count <= int(@fisico)-1 ; $count++ )
{
(my $oid, $rede[$count]) = split(/\:/, $rede[$count]);
if ($rede[$count] eq $search)
{
($oid, my $mac) = split(/\:/, $fisico[$count]);
$mac = unpack 'H*', $mac;
return $mac;
}
}
}