|
Re: mac to IP address?
by rob_au (Abbot) on Jan 23, 2004 at 01:59 UTC
|
| [reply] |
Re: mac to IP address?
by b10m (Vicar) on Jan 23, 2004 at 02:01 UTC
|
I am not aware of a nice perl way to do it, but a very nasty hack could be (on *NIX systems):
my $arp = `/usr/sbin/arp -a`;
my $mac = "aa.bb.cc.dd.ee.ff";
if($arp =~ m/\(([\d\.]+)\) at $mac/) {
print "$1\n";
}
Update: please do note that the MAC address needs to be in the arp cache for this approach.
| [reply]
[d/l] |
|
|
I tried 'arp -a' on my router
? (203.7.224.11) at 00:04:27:FD:E1:A1 [ether] on eth1
? (128.8.10.90) at 00:04:27:FD:E1:A1 [ether] on eth1
? (66.39.54.27) at 00:04:27:FD:E1:A1 [ether] on eth1
? (192.168.1.3) at 00:10:5A:72:63:65 [ether] on eth0
? (210.49.1.23) at 00:04:27:FD:E1:A1 [ether] on eth1
? (192.149.252.21) at 00:04:27:FD:E1:A1 [ether] on eth1
? (202.154.92.35) at 00:04:27:FD:E1:A1 [ether] on eth1
? (198.246.0.28) at 00:04:27:FD:E1:A1 [ether] on eth1
? (204.74.112.1) at 00:04:27:FD:E1:A1 [ether] on eth1
? (137.92.140.80) at 00:04:27:FD:E1:A1 [ether] on eth1
? (63.192.96.3) at 00:04:27:FD:E1:A1 [ether] on eth1
? (172.17.1.249) at 00:04:27:FD:E1:A1 [ether] on eth1
? (192.36.148.17) at 00:04:27:FD:E1:A1 [ether] on eth1
? (192.168.1.20) at 00:0D:60:11:60:80 [ether] on eth0
? (192.175.48.6) at 00:04:27:FD:E1:A1 [ether] on eth1
? (202.12.28.131) at 00:04:27:FD:E1:A1 [ether] on eth1
? (64.29.18.163) at 00:04:27:FD:E1:A1 [ether] on eth1
? (172.17.1.80) at 00:04:27:FD:E1:A1 [ether] on eth1
? (202.154.106.97) at 00:04:27:FD:E1:A1 [ether] on eth1
? (128.250.36.2) at 00:04:27:FD:E1:A1 [ether] on eth1
? (128.250.36.3) at 00:04:27:FD:E1:A1 [ether] on eth1
? (128.250.37.2) at 00:04:27:FD:E1:A1 [ether] on eth1
? (202.154.95.173) at 00:04:27:FD:E1:A1 [ether] on eth1
? (203.21.37.18) at 00:04:27:FD:E1:A1 [ether] on eth1
? (129.127.28.4) at 00:04:27:FD:E1:A1 [ether] on eth1
? (211.115.194.21) at 00:04:27:FD:E1:A1 [ether] on eth1
see the pattern?
The arp won't help you getting IP's from networks after you have traversed a router (please correct me if I'm wrong). It only gives the MAC address of the router that can help get your packets to where they need to go. | [reply]
[d/l] |
|
|
Well, yes. That looks like a "problem". And consider one server within your network that has multiple IP addresses on one NIC ... RARP seems more usefull to you than ARP. I never really looked into that though, so I couldn't tell you exactly how it'd work (and I must say that I am too tired and lazy right now to read the RFC myself ;)
| [reply] |
|
|
> I tried 'arp -a' on my router
> ? (203.7.224.11) at 00:04:27:FD:E1:A1 [ether] on eth1
> ? (128.8.10.90) at 00:04:27:FD:E1:A1 [ether] on eth1
> ? (66.39.54.27) at 00:04:27:FD:E1:A1 [ether] on eth1
You only get this if the router's been configured to use proxy arp - this isn't normally necessary or desirable | [reply]
[d/l] |
|
|
# ping 192.168.0.255
where your network address is 192.168.0.0, and your netmask
is 255.255.255.0.
Otherwise, arp has only those IPs you talked to. | [reply]
[d/l] |
|
|
Not all hosts will respond to broadcast pings. For example, the Linux hosts respond but the Windows 2000 hosts don't.
| [reply] |
Re: mac to IP address?
by flyingmoose (Priest) on Jan 23, 2004 at 02:02 UTC
|
You do realize these aren't exactly the same thing, right?
Want to do this for a machine other than your own? This is doable if you own the DHCP server or the router, but it depends on what technology you are using.
For just your computer, run 'arp -a'. There are no doubt Perl modules for this, but it's darn trivial enough to parse the output of arp or ifconfig -- info available on Google.
| [reply] |
|
|
flyingmoose is right. The mac address and ip address are two different things that work on different layers of the OSI model. There are ways to determine what mac address is associated with an ip address but then again you can run into problems like recieving a mac address from a switch or hub. Why do you want to do this anyway?
| [reply] |
Re: mac to IP address?
by hardburn (Abbot) on Jan 23, 2004 at 04:56 UTC
|
Hardly twisted at all. This is exactly what Reverse Address Resolution Protocol (RARP) is for. Though in the case of trying to automatically set a machine's IP, you're better off with DHCP. I suspect you have some other twisted purpose, though.
----
I wanted to explore how Perl's closures can be manipulated, and ended up creating an object system by accident.
-- Schemer
: () { :|:& };:
Note: All code is untested, unless otherwise stated
| [reply]
[d/l] |
Re: mac to IP address?
by coec (Chaplain) on Jan 23, 2004 at 02:34 UTC
|
I could be way, way off base here but I'd ask how the ARP (address resolution protocol) works. If you've every used:
tcpdump -p arp
tcpdump: listening on eth0
10:30:43.935182 arp who-has 192.168.1.20 tell 192.168.1.1
10:30:43.935423 arp reply 192.168.1.20 is-at 0:d:60:11:60:80
you can see the 'who-has' request, followed by the 'reply'.
Maybe NetPacket::ARP can help you with this. | [reply]
[d/l] |
Re: mac to IP address?
by prostoalex (Scribe) on Jan 23, 2004 at 18:09 UTC
|
If the IP addresses are distributed by the DHCP server that you have access to, it's possible to open up the DHCP leases file (different locations on different distros) and just parse the data from there with a simple regexp.
| [reply] |
Re: mac to IP address?
by Anonymous Monk on Jan 23, 2004 at 18:41 UTC
|
Is the Mac address you are trying to find the IP address for on the same layer-2 network? E.G. connected by a switch or a hub to you. Or is it on a different layer-2 network, traversing 1 or more layer-3+ devices?? E.G. Routers.
--LR
| [reply] |
Re: mac to IP address?
by blue_cowdawg (Monsignor) on Jan 24, 2004 at 15:49 UTC
|
If I take your question at face value I have to answer
"NO" and say that there is no mapping
of MAC address ==> IP address in the strictest sense
of the wording. A MAC address is a hardware address
usually assigned by a manufacturer (on some hardware
you can set all or some of the MAC address in the field
but I believe that has been depricated in most cases)
and an IP address is assigned by a system or network
administrator.
On the other hand, depending your OS you can to a very
limited degree find a matching IP address for a given
MAC and let me iterate some of the methods I would
pursue:
ARP Caches
Mentioned elsewere in this thread is the concept of using
an APR cache to lookup a hardware address and map it to
an IP address. Let me look at two approaches for that:
Local ARP
On a *NIX system you can run a command called
arp with the -a and it will dump
the system's ARP cache to stdout. On my Linux box at
home I get this kind of result from the command line:
$ /sbin/arp -a
router.isp.net (168.239.116.1) at 00:01:5C:22:3C:42 [ether] on eth0
Note:IP addresses and names been changed to protect
me!
If I wrte a Perl script to parse that I can map the ARP
address 00:01:5C:22:3C:42 to it's
associated IP address trivially.
The HUGE disadvantage this method has is only the
ARP addresses for my local subnet are valid. If a host
on the other side of the router from me then what is
mapped into the ARP cache for a given IP address is the
MAC address of the router. Not much help is it?
Other ARP caches
Another scheme would be to look at the ARP caches of every
network device on my network and check it's ARP cache
weeding out MAC addresses belonging to network devices.
In point of fact I wrote something called routerWalk
several years ago that does just that. It logs onto the
first router it sees, dumps its ARP cache, sifts through
it and compares it to the routing table to determine
which MAC addresses are valid and which belong to routers
and stores the reesult. I wrote this in order to validate
data stored in our IP Management system (QIP) and find
unregistered hosts.
For that application that approach worked well but
to do this every time you run a script that wants to
reference that data would be impractical and a major
PITA as well as not exactly a good way to make friends
with your network operation folks.
Databases
Rarely actually populated but still do exist are
the /etc/ethers files as well as the network distributed
forms of them through NIS, NIS+ or whatever. If you have
those available to you, use them.
In my environment I can actually query for that
information against my QIP database and solve the
problem that way.
Enjoy!
Peter L. Berghold -- Unix Professional
Peter at Berghold dot Net |
| |
Dog trainer, dog agility exhibitor, brewer of
fine Belgian style ales. Happiness is a warm, tired, contented dog curled up at your side and
a good Belgian ale in your chalice. |
| [reply]
[d/l]
[select] |
|
|
There is another choice to get the MAC to IP address mappings. I have heard of a utility called arpwatch. It is a daemon that listens to the network and records all the ARP packets it sees. Since ARP is broadcast, the daemon can get a pretty good view of all the mappings on the local subnet. I know arpwatch comes with some Linux distributions.
| [reply] |
|
|
I have heard of a utility called arpwatch. It is a daemon
I know arpwatch comes with some Linux distributions.
I thought of arpwatch but dismissed it for two
reasons:
- It does not come "standard" everywhere
which in my mind is a minor reason to not include
it.
- Because as you pointed out it is a daemon and not
a CLI utility (IIRC) it isn't much use to a Perl programmer.
There are other utilities as well such as tcpdump
and snoop but I think they aren't what the OP had
in mind either.
If what you are after is to take an ETHERNET address
and convert it to an IP address "right now" then
none of the utilites such as snoop, arpwatch
or tcpdump are going to be of much use.
Peter L. Berghold -- Unix Professional
Peter at Berghold dot Net |
| |
Dog trainer, dog agility exhibitor, brewer of
fine Belgian style ales. Happiness is a warm, tired, contented dog curled up at your side and
a good Belgian ale in your chalice. |
| [reply] |