Retrieving a remote MAC address

[Roberto García López]

Hi there,

How can I get the MAC address from a remote PC having its IP address?

Thanks.

[Rui Ueyama]

Do you want to get a MAC address on the same network? If so, I'd run "arp" command and parse the result.

--
You received this message because you are subscribed to the Google Groups "golang-nuts" group.
To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Roberto García López]

Hi Rui,

Thanks for your quick response. I've tried your solution and it works!

But for some reasons I would like to implement by myself the way to get the MAC address, like "arp" command does. The idea is to avoid using an external command that can change its output in the future. Can you give me a clue about how to do it?

Thanks.

[Rui Ueyama]

I don't think there's a way to look up the arp table in a portable manner. On Linux you are able to open /proc/net/arp and parse it, and it may be better than running "arp" as you'd break the dependency to the external command, but I don't know how stable the file format is, and of course the file may not exist on other OSes.

--

[Jean-Alexandre Peyroux]

Hello,

You can try this api : http://godoc.org/code.google.com/p/gopacket ?

Regards

--

[Konstantin Khomoutov]

On Mon, 25 Aug 2014 14:06:44 -0700 (PDT)

Roberto García López <vcr...@gmail.com> wrote:

Note two things:

* ARP table has (tweakable) expiration policy.
If memory serves me right, the default TTL for its entries is
something around 1.5 minutes.
After that time, the entry for the IP address of interest will be
removed and not reappear there until another ARP request for that
IP address is issued and the reply for it is received.

* ARP serves to glue the link layer (say, Ethernet) with the transport
layer (IP), and the link layer typically "exists" "just between"
two endpoints exchanging the transport layer's traffic.

What this means for you, is that on an Ethernet network which uses
switches (and this is just about any such network of a sensible size)
you won't ever see the MAC addresses of your peers with which you're
exchanging messages via that switch. These entries will be in the
ARP table of the switch itself.

If the latter point is not your case (you're certain that you're
exchaning traffic with your peer directly), it seems, the only way to
go, suggested by Jean-Alexandre Peyroux, is to use packet sniffing
while exchanging normal traffic with the host and then correlate what
was captured with what you were exchanging.

Raw sockets are too high-level and won't allow you reach for link-layer.

[Rui Ueyama]

It's true that arp table entries have limited lifetime, and there's a chance that you miss an arp table entry because either (1) it's expired or (2) does not exist from the beginning. The latter happens if your machine have never send a packet to the host having the target IP address.

(The third possibility is, as you mentioned, that there is a router in between, but I think we could eliminate that because Roberto replied that arp command worked.)

However I don't think you'd really want to go so far as to do packet sniffing. It may need a capability and usually not very easy to do. I think I'd send a ping packet to the IP address that I'm trying to look up, in order to make sure that we resolve the MAC address of the targetIP, and then look up the table in /proc/net/arp.

[Konstantin Khomoutov]

On Tue, 26 Aug 2014 13:59:42 -0700
"'Rui Ueyama' via golang-nuts" <golan...@googlegroups.com> wrote:

[...]

> However I don't think you'd really want to go so far as to do packet
> sniffing. It may need a capability and usually not very easy to do. I
> think I'd send a ping packet to the IP address that I'm trying to
> look up, in order to make sure that we resolve the MAC address of the
> targetIP, and then look up the table in /proc/net/arp.

Well, that is true, I just wanted to highlight that a process which sent
ICMP echo packet and got an ICMP echo reply back should be prepared to
not find an entry for the IP address of the host it communicated with
in the ARP cache for different possible reasons.

[Roberto García López]

Rui Ueyama you're right I'm interested in getting the MAC in a local network only.

Jean-Alexandre I was checking the gopacket and maybe it helps to solve the problem

It's very interesting to know why the MAC address sometimes is not available.

The problem I have is that the app have to be cross platform so I'm avoiding the use of particular commands in each platform.

I think that I'll have to implement it seeing how the arp command gets the MAC address and implement it by myself.