Re: ARP, getting mac address from IP address

P.Lister@cranfield.ac.uk
Thu, 02 May 96 14:59:25 +0100

-----BEGIN PGP SIGNED MESSAGE-----

Content-Type: text/plain; charset=us-ascii

> I am looking for a way to resolve an IP address to an associated MAC
> address with out depending on SNMP. I am trying to do this with in a
> scotty script. ANY Ideas?

Been there, done that! The preliminary version's a bit ropey, but in a few
days I should have a useable set of Ethernet tools, which includes address
table harvesting.

> 1) use SNMP to query the address table of a nearby router (preferably
> after sending the device a ping packet)

I'd advise a selection of routers, networked printers and file servers, since
lots of different systems use them. Sadly, it appears that our DEC Alpha file
servers, which should have very full address tables have very braindead
snmpds, and return lots of garbage. :-(

> 2) find a local machine on the same subnet as the target machine, ping
> the target from that machine, and then probe it's ARP table for the
> MAC address.

If there's no subnetting at all, quite likely if one has a largely bridged
net, then one can use the local address table of the system running scotty
(and you don't need snmp, arp -a will do the trick). Trouble is, it only works
if the target is up and running. If you have subnetting with routers that use
ARP spoofing, then you've got to be careful that the MAC address you see is
that of the target, not the router; however, it should be possible to harvest
the router's own address table if it speaks SNMP.

Another way is arpwatch, parsing the resulting arp.dat file. Very effective,
in that you don't have to have the target running while updating the scotty
db, you get notification of IP clashes (we have far too many of these), and
you also often get to see the real MAC address before DECnet screws it up on
systems where this is a problem. Also, you get to see non-IP MAC addresses. I
may even hack a version of arpwatch to update my database directly.

If you have clients that use bootp/rarp, you can lookup the bootptab.

- --
Peter Lister Email: p.lister@cranfield.ac.uk
Computer Centre, Cranfield University Voice: +44 1234 754200 ext 2828
Cranfield, Bedfordshire MK43 0AL UK Fax: +44 1234 751814
- --- How would I create the universe if I had the chance? A Einstein ---

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2i

iQCVAwUBMYi/uk0IjEzZ62ARAQEnmwQAhCLWHozWxoESOIYhwAkPZUOga4UIpDBk
On/jMidCekzlxszAhlncHfiCaW+eA90PuqWk01oes7lcY0EFZTOPtzAz4y8nAQlB
lFsTrUqvfPXgISKx10lZlk9YfchN66uhJ7aa/0NkY9y1q4KmXXnUO+Ah6KB0kznq
oUkj/jNh2xY=
=ur3S
-----END PGP SIGNATURE-----