in reply to mac to IP address?

I am not aware of a nice perl way to do it, but a very nasty hack could be (on *NIX systems):

my $arp = `/usr/sbin/arp -a`;
my $mac = "aa.bb.cc.dd.ee.ff";

if($arp =~ m/\(([\d\.]+)\) at $mac/) {
  print "$1\n";
}

[download]

Update: please do note that the MAC address needs to be in the arp cache for this approach.

--
b10m

Replies are listed 'Best First'.
Re: Re: mac to IP address?
by coec (Chaplain) on Jan 23, 2004 at 02:40 UTC
    I tried 'arp -a' on my router 
    ? (203.7.224.11) at 00:04:27:FD:E1:A1 [ether] on eth1
? (128.8.10.90) at 00:04:27:FD:E1:A1 [ether] on eth1
? (66.39.54.27) at 00:04:27:FD:E1:A1 [ether] on eth1
? (192.168.1.3) at 00:10:5A:72:63:65 [ether] on eth0
? (210.49.1.23) at 00:04:27:FD:E1:A1 [ether] on eth1
? (192.149.252.21) at 00:04:27:FD:E1:A1 [ether] on eth1
? (202.154.92.35) at 00:04:27:FD:E1:A1 [ether] on eth1
? (198.246.0.28) at 00:04:27:FD:E1:A1 [ether] on eth1
? (204.74.112.1) at 00:04:27:FD:E1:A1 [ether] on eth1
? (137.92.140.80) at 00:04:27:FD:E1:A1 [ether] on eth1
? (63.192.96.3) at 00:04:27:FD:E1:A1 [ether] on eth1
? (172.17.1.249) at 00:04:27:FD:E1:A1 [ether] on eth1
? (192.36.148.17) at 00:04:27:FD:E1:A1 [ether] on eth1
? (192.168.1.20) at 00:0D:60:11:60:80 [ether] on eth0
? (192.175.48.6) at 00:04:27:FD:E1:A1 [ether] on eth1
? (202.12.28.131) at 00:04:27:FD:E1:A1 [ether] on eth1
? (64.29.18.163) at 00:04:27:FD:E1:A1 [ether] on eth1
? (172.17.1.80) at 00:04:27:FD:E1:A1 [ether] on eth1
? (202.154.106.97) at 00:04:27:FD:E1:A1 [ether] on eth1
? (128.250.36.2) at 00:04:27:FD:E1:A1 [ether] on eth1
? (128.250.36.3) at 00:04:27:FD:E1:A1 [ether] on eth1
? (128.250.37.2) at 00:04:27:FD:E1:A1 [ether] on eth1
? (202.154.95.173) at 00:04:27:FD:E1:A1 [ether] on eth1
? (203.21.37.18) at 00:04:27:FD:E1:A1 [ether] on eth1
? (129.127.28.4) at 00:04:27:FD:E1:A1 [ether] on eth1
? (211.115.194.21) at 00:04:27:FD:E1:A1 [ether] on eth1

    [download]
    see the pattern?

    The arp won't help you getting IP's from networks after you have traversed a router (please correct me if I'm wrong). It only gives the MAC address of the router that can help get your packets to where they need to go.

[reply]
[d/l]

      Well, yes. That looks like a "problem". And consider one server within your network that has multiple IP addresses on one NIC ... RARP seems more usefull to you than ARP. I never really looked into that though, so I couldn't tell you exactly how it'd work (and I must say that I am too tired and lazy right now to read the RFC myself ;)

[reply]
      > I tried 'arp -a' on my router

> ? (203.7.224.11) at 00:04:27:FD:E1:A1 [ether] on eth1
> ? (128.8.10.90) at 00:04:27:FD:E1:A1 [ether] on eth1
> ? (66.39.54.27) at 00:04:27:FD:E1:A1 [ether] on eth1

      [download]
      You only get this if the router's been configured to use proxy arp - this isn't normally necessary or desirable
[reply]
[d/l]
Re: Re: mac to IP address?
by cleverett (Friar) on Jan 23, 2004 at 06:52 UTC

    Ping the broadcast address for your network to fill your arp cache:

    # ping 192.168.0.255

    [download]

    where your network address is 192.168.0.0, and your netmask is 255.255.255.0.

    Otherwise, arp has only those IPs you talked to.

[reply]
[d/l]
      Not all hosts will respond to broadcast pings. For example, the Linux hosts respond but the Windows 2000 hosts don't.
[reply]

In Section Seekers of Perl Wisdom