|
tapesorcdz has asked for the wisdom of the Perl Monks concerning the following question:
Hi, I'm quite new here, but I have a perl question. How do I obtain the MAC Address of all the computers on my network?? Is it in the registry somewhere or will the location be different for each machine?
Also, how do I obtain the NIC device in this format on each computer "NetBT_El90x1"??? thanks for any help. I read old posts about the MAC Address problems, but wondering if anything new has come up.
James |
Re: MAC Address and NIC Device on Network.
by tadman (Prior) on Jun 27, 2001 at 03:55 UTC
|
The way you find out NIC addresses is using ARP, or Address
Resolution Protocol. It is used by Ethernet network drivers
to figure out what the MAC address of a given destination is.
You can use ARP to do what you want.
There's two tricks, both UNIX-based. Your system and privileges
will affect what you can choose.
The easy way, though it requires "root" level access on
a UNIX-type system, is to use 'arping'. You just tell it
who you want to ping, and where, and it comes back with
an ARP response all broken out for you, such as:
Unicast reply from 24.114.X.X [00:01:64:A5:F9:00] 2.588ms
The other way is to just use the off-the-shelf 'ping' program
a whole whack of times to stimulate ARP responses from as many
remote nodes is required.
Remember that there won't be any entries in the ARP table unless
the machine your on hasn't had to communicate with anyone.
The ARP entries also expire after a period of time, though
it is at least a few minutes.
Then you can read the ARP table
directly from your system (i.e. /proc/arp) or by using the
'arp' program which will give you something like:
? (10.3.3.10) at 00:E0:29:25:7A:46 [ether] on eth0
? (24.114.X.X) at 00:01:64:A5:F9:00 [ether] on eth1
Once you've got the MAC address, you can do a few lookups
to find out who might have made that gear. Each "vendor"
is allocated a unique three-octet beginning, so you can
guesstimate what that device is by this data.
The trick is to find a comprehensive table of registrations.
The IANA (Internet Assigned Numbers Authority) is supposed
to do this, but their material is out of date even
though they are the ones who issue numbers. Can you believe
they have a "gopher://" URL in that file? Yikes.
The IEEE seems to have
a pretty good, parsable file at here.
See if that's to your liking. | [reply]
[d/l]
[select] |
Re: MAC Address and NIC Device on Network.
by vladdrak (Monk) on Jun 27, 2001 at 05:27 UTC
|
There is a Resource Kit utility called getmac.exe that can prove useful. You'll want to either compile a list of the machines you want to check, or enumerate an NT domain to check those machines. You could also walk IP addresses if you don't have a network browse list built up.
Anyways, your code might be:
my @machines=("host1","host2","host3");
my %macs=();
for my $machine (@machines) {
my $macraw=`getmac $machine`;
if ($macraw =~ /(match something)/) {
$macs{$1}=$machine;
}
}
print "$macs{$_} $_\n" for (keys %macs);
Which would fill $macraw with something like this:
Transport Address Transport Name
----------------- --------------
00-00-00-00-00-00 \Device\NetbiosSmb
00-A0-B0-6C-38-D0 \Device\NetBT_El90x1
..which you'll clean up with the regex buffer, and then toss it in a hash. The NetBT_El90x just identifies the interface as a 3Com 9xx card. Intels show as E100b, Compaq NetFlex as NetFlx, etc. In Win2k the identifer is actually a GUID that maps back to the driver/service name (joy!). If you have a good idea of what NICs are on your LAN it makes it easier.. you'll probably want to do a dirty scan first on everything, then refine your regex.
Good Luck,
Vlad | [reply]
[d/l]
[select] |
Re: MAC Address and NIC Device on Network.
by admiral llama (Initiate) on Jun 27, 2001 at 06:51 UTC
|
| [reply] |
|
|
All boxen that implement the TCP/IP protocol must respond. Even windows machines manage it.
You can catch the return packets with Net::Packet (Update: It's NetPacket, not Net::Packet, available from CPAN, runs under windows with the pcap library), if you have root access. I have a little proggie that does this if you are interested. Actually it sits there and silently matches ethernet addresses to IPs, and identifies gateways and routers from that data.
For extra humour during a boring afternoon, ping flood the broadcast address and watch the network admin go into spasms. ____________________
Jeremy
I didn't believe in evil until I dated it.
| [reply] |
|
|
Or just parse `arp -a`.
Update: The original question seems clearly to be about Windows, which does come with "arp" (I think Win2K was mentioned in the chatterbox). Your mention of "root access" makes me wonder whether Net::Packet will work on Win2K, but I don't find it on CPAN so I didn't go any further trying to check that out.
I didn't say the method that I mentioned was the only way, of course.
Update2: Thanks for the clarifications, jepri. I can still roll code to parse `arp -a` faster than I can download NetPacket and pcap much less install them and get them working (heck, nearly faster than I can find NetPacket given how slow http://search.cpan.org/ is these days). So if all I'm interested in the MAC addresses, I'll stick with arp output unless I've already gotten NetPacket working for other reasons.
But I didn't reply to criticize your suggestion. I just waited a while and noted that no one else had mentioned "arp -a" yet so I thought it should be part of the thread. So I decided to post it in reply a node that mentioned something acurate and your fact about all TCP/IP stacks having to support ARP won. (:
-
tye
(but my friends call me "Tye")
| [reply]
[d/l]
[select] |
|
|
|
|
That's something to be careful with - anyone who pulled a stunt like that on my network would get the plug pulled on their connection in a heartbeat, and not just because it happens to be the first step of several DoS attacks. It's also not the most reliable method:
- A machine's arp cache is only of finite size, so you can only capture so many addresses
- Since every machine will be answering all at once, there's a very good chance that some of the replies will just get dropped
- Any machines that are behind a router, will simply appear with the routers mac address if the router even passes the packet at all.
The approach of running a prog on each station that reports back the mac to a central server is probably the most reliable and network-friendly way to go.
| [reply] |
|
|
