Ronnie has asked for the wisdom of the Perl Monks concerning the following question:

Excuse my ignorance here as the question I'm about to ask may well be very dumb! Is there any way to get a list of mac addresses from a list of hardware devices. I need to find out the mac/ethernet addresses of several hundred PC's on our network (for a software upgrade). Any ideas? I thought Net::Address::Ethernet would do this but it looks like it only works for locally conected hardware. Cheers

Replies are listed 'Best First'.
Re: Mac Addresses
by monarch (Priest) on Oct 04, 2006 at 10:09 UTC
    If you are on a LAN you can try sending a broadcast ping (ping -b 255.255.255.255 on linux) which any compliant device will respond to. Then you can get a list of MAC addresses by looking up the ARP cache (arp -a on linux).

    Note that this will only get the addresses of devices on the local Ethernet segment. Not every device will respond to a broadcast ping.

    If you want MAC addresses of devices beyond the current Ethernet segment (ie devices that are a router hop or more away) then you will have to get that device to volunteer the MAC address information by using a SNMP query or by installing your own special client software on each of those remote devices.

Re: Mac Addresses
by Velaki (Chaplain) on Oct 04, 2006 at 10:07 UTC

    I think you're going to have to take a different tack on this one. E.g. If you have Cisco Catalysts, you might be able to poll them for their CAM tables, and pull back connected info from that, but the best way to get these addresses is probably by polling a hardware information program resident on each PC.

    Net::Address::Ethernet essentially returns the MAC address of physically installed ethernet cards on the machine. Not on other machines. If you can get the program to run on the other machines remotely, then you might be able to poll them all. Do you have some bulk distribution mechanism for the PCs?

    Wish I could be more help,
    -v

    Update: see monarch's post, below, for excellent info about SNMP polling and segment restrictions.

    "Perl. There is no substitute."
Re: Mac Addresses
by traveler (Parson) on Oct 04, 2006 at 15:14 UTC
    If your hosts all have IP addresses and you have a DNS server for them:
    • use Net::DNS to enumerate all the hosts listed
    • for each host use Net::ARP to find the addresses of the hosts on the local segment
    • If there are hosts on the "other side" of a router, use SNMP to retrieve those from the router or run this program on each segment
Re: Mac Addresses
by spadacciniweb (Curate) on Oct 04, 2006 at 13:07 UTC
    I'm not sure to understand you question,
    but if you have SNMP-aware switch in your lan,
    you can install on your pc MacAddressLocator.
Re: Mac Addresses
by NetWallah (Canon) on Oct 04, 2006 at 16:08 UTC
    You appear to have a medium sized network - which would normally be divided into subnets and/or VLANs, most likely all connected to a core router.

    The core router in this scenerio would be the only device that is aware of all other devices that are communicating on the network, and it needs to maintain an ARP cache.

    You should be able to get the contents of the ARP cache, which contains MAC to IP address mappings, either via SNMP, or via telent.

    if you /msg me, I could share a crude but functional perl script that I have that collects this information using Net::Telnet, from an Enterasys router.

         "For every complex problem, there is a simple answer ... and it is wrong." --H.L. Mencken

      That script may not be portable to other routers (or even work on some simple routers or that don't support SNMP). Nor would the router know about MAC's that haven't passed a packet through. But it gave me a good idea.

      Assuming this all on a local net and the subnets are not firewalled from each other (ie. no firewall between the local subnets - Firewalls between the local net and the internet would be fine). Just ping each ip in the net. If this is your local net you should have no problem getting the network info.

      Then all you have to do poll you local ARP table. Which far easier than wirting a custom router poller.



      grep
      One dead unjugged rabbit fish later
        Your first paragraph makes valid points, but your conclusion :
        -- all you have to do poll you local ARP table --
        will not work if you have multiple routed subnets, because of proxy ARP.

             "For every complex problem, there is a simple answer ... and it is wrong." --H.L. Mencken

Re: Mac Addresses
by lyklev (Pilgrim) on Oct 04, 2006 at 20:27 UTC
    If you have root access to one of the pc's on the same subnet as the dhcp server, a tcpdump filtered for arp requests will (eventually) give you a list of mac adresses. Well, actually it gives you a lot more, but it takes 'some' filtering (this is where Perl comes in!).
Re: Mac Addresses
by RobPayne (Chaplain) on Oct 04, 2006 at 23:55 UTC
    arpwatch doesn't run on windows, but if you have other boxen on your network, it might be of use to you. (note: IP has been inferred from your question, but not stated. Windows has been inferred, though the OS running on the PCs is also unstated.) arping also has a dependency of unix or unix-like OS. Both tools provides output that predictable and therefore easily parsed by perl.