IPs from MACs?

[Tobias Unruh]

Hi,

Does anyone knows a method to get current IPs from MACs?

Thanks for any idea!

Tobias

[Thornton Prime]

I believe that this is what arp is all about.

thornton

[Ken Westerback]

If you have recently communicated with the NIC you should be able to use
the command

arp -vn

to list your current arp cache, which will list the MAC to IP mappings
currently in force at your machine. You might have to be root.

---- Ken

Tobias Unruh wrote:
>
> Hi,
>
> Does anyone knows a method to get current IPs from MACs?
>
> Thanks for any idea!
>

> Tobias

[john]

Nope. Arp maps MACs to IPs. I believe he's trying to get a host to learn
it's IP based on its MAC a la a thin client, in which case the answer
would be bootp.

Thornton Prime wrote:

> Tobias Unruh wrote:
> >
> > Hi,
> >
> > Does anyone knows a method to get current IPs from MACs?
> >
> > Thanks for any idea!
>

> I believe that this is what arp is all about.
>
> thornton
>

--
John
jo...@innernatures.com

[Malware]

Hi Tobias,

you wrote:
> Does anyone knows a method to get current IPs from MACs?

I don't know from what backround you came into that question. If you try
to determinate duplicate IP problems you may have luck if all the
machines support RARP - what is quite unusual. If you try to allocate an
IP for a machine on boot - where it only knows its NIC MAC - have a look
into BOOTP and/or DHCP.

Malware

[Brian McCauley]

Ken Westerback <k...@tcn.net> writes:

> Tobias Unruh wrote:

> > Does anyone knows a method to get current IPs from MACs?

> If you have recently communicated with the NIC you should be able to use

> the command
>
> arp -vn
>
> to list your current arp cache, which will list the MAC to IP mappings
> currently in force at your machine. You might have to be root.

If the machine is not directly connected to your LAN then you have to
either ask the host itself or the last hop router using SNMP.

Does anyone know of a tool to automate this?

Here's how to the MAC address of my machine (med150.bham.ac.uk) by hand:

First you traceroute to it:

$ traceroute med150.bham.ac.uk
[snip]
13 gw-cc20-8.bham.ac.uk (147.188.171.2) 117.245 ms 117.427 ms
121.131 ms
14 gw-md20.bham.ac.uk (147.188.172.5) 118.746 ms 128.774 ms
120.176 ms
15 wolfson-gate.bham.ac.uk (147.188.67.23) 118.531 ms 126.273 ms
130.591 ms
16 med150.bham.ac.uk (147.188.68.20) 119.569 ms 120.726 ms 119.05 ms

Then (before the ARP cache expires) you ask wolfson-gate.bham.ac.uk
for it's arp table:

$ snmpwalk wolfson-gate.bham.ac.uk public at
[ irrelevant info snipped ]
at.atTable.atEntry.atPhysAddress.2.1.147.188.68.20 = Hex: 00 00 B4 82 59 6C
at.atTable.atEntry.atNetAddress.2.1.147.188.68.20 = IpAddress: 147.188.68.20

From this you can find that 147.188.68.20 is 00-00-B4-82-59-6C.

If the host itself talks SNMP you can ask it directly. To find the MAC
address of wolfson-gate itself you'd use the following information:

ip.ipAddrTable.ipAddrEntry.ipAdEntAddr.147.188.67.23 = IpAddress: 147.188.67.23
ip.ipAddrTable.ipAddrEntry.ipAdEntIfIndex.147.188.67.23 = 3
interfaces.ifTable.ifEntry.ifPhysAddress.3 = Hex: 00 E0 29 04 DA C4

Of course you can't actually do this as I'm not about to accept SNMP
queries from just anyone, but the method is valid so long as you have
SNMP access.

--
\\ ( ) No male bovine | Email: B.A.Mc...@bham.ac.uk
. _\\__[oo faeces from | Phones: +44 121 471 3789 (home)
.__/ \\ /\@ /~) /~[ /\/[ | +44 121 627 2173 (voice) 2175 (fax)
. l___\\ /~~) /~~[ / [ | PGP-fp: D7 03 2A 4B D8 3A 05 37...
# ll l\\ ~~~~ ~ ~ ~ ~ | http://www.wcl.bham.ac.uk/~bam/
###LL LL\\ (Brian McCauley) |