Beefy Boxes and Bandwidth Generously Provided by pair Networks
go ahead... be a heretic

Fetching ARP table with NetPacket

by RnC (Sexton)
on Jun 01, 2004 at 12:37 UTC ( #358009=perlquestion: print w/replies, xml ) Need Help??
RnC has asked for the wisdom of the Perl Monks concerning the following question:

Hello. Anyone out there knows a way to fetch all ipaddresses->mac addresses from the local ARP table ? I heard it's possible with NetPacket, however I did not succeed in writing a script. Thanks for any help. btw: I know one can parse the result from "arp -a". But i really need to do it without using this method.

Replies are listed 'Best First'.
Re: Fetching ARP table with NetPacket
by hsinclai (Deacon) on Jun 01, 2004 at 14:47 UTC

    But i really need to do it without using this method.
    I was curious why you have this limitation..

    I am not sure if you refer to Windows perl module Win32::NetPacket or the unix packet.h stuff.

    Whatever platform you're on already has a quick method to access the arp table without resorting to an extra layer of activity - the info is already right there!!

    Curious why you might want to get the arp data - perhaps knowing your ultimate goal might help come up with a solution... realizing that the arp table stuff, except for some very specific reasons, is generally not all that useful- what with aging, looking at the arp table is not a precise indicator of what IP addresses are "out there" at the moment. Additionally interfaces that are in fact "out there" may not, at any given moment, be in the arp table.

      In this case, GNU/Linux, I could use the arp command. Indeed I don't need this script to know "who's online", or anything like it, but I do need it because I wanted an example of how I could fetch the mac address of the network interfaces I have installed on my machine using code (it's a research work, by the way), and not internalizing another program such as system("arp -a"). I also ocurred me that it could be useful to fetch the entire arp table, so I asked the question as above :) I imagine I could fetch it from /proc. But I'm not sure how portable this solution is. I know it stands almost for the same as fetching from the "arp -a" results, but it's more tolerable from the point of view of this research (not my idea). Again, any help is appreciated.

        I'm sure there are shorter, much more elegant ways of doing this (hire a monk:), plus in a multi-interface system, you'd want more info about which "device" from the arp table.. but, here's a basic approach..
        #!/usr/bin/perl -w # kernels 2.4.x /proc/net/arp use strict; my $ipad; my $macad; my @arp; if ( -r "/proc/net/arp" ) { open(ARP,"</proc/net/arp"); @arp = <ARP>; close(ARP); } else { die("Cannot access arp in proc $!"); } foreach my $linein ( @arp ) { chomp($linein); next if $linein =~ /IP/i; $ipad = (split(/\s+/,$linein))[0]; $macad = (split(/\s+/,$linein))[3]; print "IP address $ipad has MAC Address $macad\n"; }

        to start with.. definitely not portable to Windows or BSD, just linux

        You could also split up each record getting a value for each field with something like
        ($ipad,$macad,$hwtype,$flags,$mask,$device) = split(/\s+/,$linein);
Re: Fetching ARP table with NetPacket
by rob_au (Abbot) on Jun 02, 2004 at 02:32 UTC
    A small script which I wrote employing Net::Pcap and NetPacket modules for determining the association between IP address and MAC addresses can be found on this site here.


    perl -le "print unpack'N', pack'B32', '00000000000000000000001011011111'"

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: perlquestion [id://358009]
Approved by sunadmn
[Your Mother]: Please don't fight, mom and dad!
[erix]: friction gives warmth!
LanX comes back ...
[LanX]: FIGHT?
LanX orders pop corn
[erix]: ha ha, you missed it

How do I use this? | Other CB clients
Other Users?
Others scrutinizing the Monastery: (9)
As of 2018-03-19 21:26 GMT
Find Nodes?
    Voting Booth?
    When I think of a mole I think of:

    Results (246 votes). Check out past polls.