Content of /etc/ethers

[Steve Keller]

Which tools read /etc/ethers, what do they expect in there, what do
they do with the contents? Is it only used to show names to a user or
take names from a user instead of MAC addresses, like in tcpdump?

The Linux man page says the entries in /etc/ethers should be numeric
IP addresses or names which can be resolved by DNS, while the FreeBSD
man page says there should be fully qualified names in /etc/ethers
which should also be in /etc/hosts.

But does really some tool get a MAC address from somewhere, converts
it to a name using /etc/ethers, and then expects to resolve that name
into an IP address?

I would like to put names of hosts or interfaces in there, which don't
necessarily have an IP address or no entry in /etc/hosts or DNS, like
switches, access points or routers with multiple interfaces,
interfaces of a Linux bridge, etc.

And may the entry in /etc/ethers contain a '.' to separate a name and
an interface number or VLAN ID, like host.0 and host.1 for the LAN and
WLAN interface?

Steve

[Greg Wooledge]

On Thu, Jan 04, 2024 at 02:07:06AM +0100, Steve Keller wrote:
> Which tools read /etc/ethers, what do they expect in there, what do
> they do with the contents?

unicorn:~$ ls -ld /etc/ethers
ls: cannot access '/etc/ethers': No such file or directory

> Is it only used to show names to a user or
> take names from a user instead of MAC addresses, like in tcpdump?

??

> The Linux man page says the entries in /etc/ethers should be numeric
> IP addresses or names which can be resolved by DNS,

unicorn:~$ man ethers
No manual entry for ethers

What man page are you reading? Is /etc/ethers on your system a file, or
a directory? What does "dpkg -S /etc/ethers" (or one of the files, if
it's a directory containing files) say it came from?

[John Hasler]

The man page for /etc/ethers (a file) is in net-tools. The file does
not exist on my Sid system.

The man page:

NAME
ethers - Ethernet address to IP number database

DESCRIPTION

/etc/ethers contains 48 bit Ethernet addresses and their corresponding
IP numbers, one line for each IP number:

Ethernet-address IP-number

The two items are separated by any number of SPACE and/or TAB
characters. A # at the beginning of a line starts a comment
which ex‐ tends to the end of the line. The Ethernet-address is
written as x:x:x:x:x:x, where x is a hexadecimal number between 0
and ff which represents one byte of the address, which is in
network byte order (big-endian). The IP-number may be a hostname
which can be resolved by DNS or a dot separated number.

EXAMPLES
08:00:20:00:61:CA pal

FILES
/etc/ethers

SEE ALSO
arp(8), rarp(8)


>From the arp man page:

-f filename, --file filename

Similar to the -s option, only this time the address info is
taken from file filename. This can be used if ARP entries for a
lot of hosts have to be set up. The name of the data file is
very often /etc/ethers, but this is not official. If no filename
is specified /etc/ethers is used as default.


--
John Hasler
jo...@sugarbit.com
Elmwood, WI USA

[Nicholas Geovanis]

On Wed, Jan 3, 2024, 8:23 PM John Hasler <jo...@sugarbit.com> wrote:

The man page for /etc/ethers (a file) is in net-tools.  The file does
not exist on my Sid system.

The man page:

  NAME
       ethers - Ethernet address to IP number database

....

Isn't that file a somehow surviving BSD-ism?

[Greg Wooledge]

On Wed, Jan 03, 2024 at 08:35:41PM -0600, Nicholas Geovanis wrote:
> On Wed, Jan 3, 2024, 8:23 PM John Hasler <jo...@sugarbit.com> wrote:
>
> > The man page for /etc/ethers (a file) is in net-tools. The file does
> > not exist on my Sid system.
> >
> > The man page:
> >
> > NAME
> > ethers - Ethernet address to IP number database
> >
> ....
> Isn't that file a somehow surviving BSD-ism?

According to <https://man.openbsd.org/ethers> it's used by the
ether_aton(3) and ether_ntoa(3) library calls.

Debian's (GNU's) libc *does* have those functions, or at least it has
a man page for them.

<https://manpages.debian.org/ether_ntoa> redirects to the current Debian
stable man page for these library functions.

What's not really stated anywhere is *why* these library functions
exist. I don't see many practical application for a library function
that reads a text file full of MAC addresses and hostnames, looks up
one of them, and spits out the other half of the line it's on. You'd
get more usefulness just doing "grep somename /etc/ethers".

The Debian ethers(5) page references arp(8), so one might conclude
that this file is intended to augment/prettify the output of "arp" so
that it contains hostnames in addition to (or instead of) MAC addresses.
But the main use of the "arp" command has always been to find out the MAC
address of a host whose IP address you already know (or can get from DNS),
but whose MAC address is not currently known. So, if you've already got
a text file full of these MAC addresses, why would you even need to run
the arp command in the first place?

It just doesn't make sense to me.

[Kushal Kumaran]

On Wed, Jan 03 2024 at 08:35:41 PM, Nicholas Geovanis <nickge...@gmail.com> wrote:
> On Wed, Jan 3, 2024, 8:23 PM John Hasler <jo...@sugarbit.com> wrote:
>
>> The man page for /etc/ethers (a file) is in net-tools. The file does
>> not exist on my Sid system.
>>
>> The man page:
>>
>> NAME
>> ethers - Ethernet address to IP number database
>>
> ....
> Isn't that file a somehow surviving BSD-ism?
>

I have a vague memory of configuring a DHCP/bootp server using
/etc/ethers as a source of static IP address assignments (possibly on a
solaris machine?). Casual web searching finds dnsmasq can do this too,
so perhaps it is a common way of configuring static addresses for dhcp
servers.

--
regards,
kushal

[Stefan Monnier]

> Which tools read /etc/ethers, what do they expect in there, what do
> they do with the contents?

AFAIK it's mostly unused nowadays. I have such a file on my DHCP
server, where `dnsmasq` reads it (lets me give static IP addresses to
some of my machines, even though they're configured via DHCP,
i.e. they're "dynamically static").


Stefan

[Mike Castle]

On Wed, Jan 3, 2024 at 6:58 PM Greg Wooledge <gr...@wooledge.org> wrote:
> What's not really stated anywhere is *why* these library functions
> exist. I don't see many practical application for a library function
> that reads a text file full of MAC addresses and hostnames, looks up
> one of them, and spits out the other half of the line it's on. You'd
> get more usefulness just doing "grep somename /etc/ethers".
>
> The Debian ethers(5) page references arp(8), so one might conclude
> that this file is intended to augment/prettify the output of "arp" so
> that it contains hostnames in addition to (or instead of) MAC addresses.
> But the main use of the "arp" command has always been to find out the MAC
> address of a host whose IP address you already know (or can get from DNS),
> but whose MAC address is not currently known. So, if you've already got
> a text file full of these MAC addresses, why would you even need to run
> the arp command in the first place?

IPv4 and IPv6 are not the only network protocols that can be used on
Ethernet. Nor were they the first, and definitely not the only ones
on unix-like systems.

One can do raw ethernet packets. Or IPX, NetBIOS (used by SMB,
Lantastic, and others), AppleTalk, Banyan's VINES, PPPoE, DECnet, ,
probably XNS.

Probably many I missed, and perhaps some future enet based protocols
that are not inet based.

Reading https://en.wikipedia.org/wiki/Xerox_Network_Systems:
> XNS also helped to validate the design of the 4.2BSD network subsystem by providing a second protocol suite, one which was significantly different from the Internet protocols; by implementing both stacks in the same kernel, Berkeley researchers demonstrated that the design was suitable for more than just IP.

The getent(1) support ethers, so you can probably use that to test any
information you put in there. As mentioned in the getent man page,
ethers is one of the databases supported by NSS.

mrc

[Fred]

Hello,

My local network uses static manually assigned IP addresses rather than
DHCP. Some equipment I designed needs to get an IP address so I
implemented RARP which is fairly simple. The /etc/ethers file is read
by one computer on the network when it receives an RARP request and
reports back the requester's IP address. There is an RARP server in the
Debian packages.

Best regards,
Fred

[Rick Thomas]

Thank you for mentioning "dnsmasq". I do the same thing on my home network and it works very well.
Rick