Beefy Boxes and Bandwidth Generously Provided by pair Networks
laziness, impatience, and hubris

MAC Address and NIC Device on Network.

by tapesorcdz (Novice)
on Jun 27, 2001 at 03:00 UTC ( #91777=perlquestion: print w/replies, xml ) Need Help??
tapesorcdz has asked for the wisdom of the Perl Monks concerning the following question:

Hi, I'm quite new here, but I have a perl question. How do I obtain the MAC Address of all the computers on my network?? Is it in the registry somewhere or will the location be different for each machine?

Also, how do I obtain the NIC device in this format on each computer "NetBT_El90x1"??? thanks for any help. I read old posts about the MAC Address problems, but wondering if anything new has come up.


Replies are listed 'Best First'.
Re: MAC Address and NIC Device on Network.
by tadman (Prior) on Jun 27, 2001 at 03:55 UTC
    The way you find out NIC addresses is using ARP, or Address Resolution Protocol. It is used by Ethernet network drivers to figure out what the MAC address of a given destination is. You can use ARP to do what you want.

    There's two tricks, both UNIX-based. Your system and privileges will affect what you can choose.

    The easy way, though it requires "root" level access on a UNIX-type system, is to use 'arping'. You just tell it who you want to ping, and where, and it comes back with an ARP response all broken out for you, such as:    Unicast reply from 24.114.X.X [00:01:64:A5:F9:00]  2.588ms
    The other way is to just use the off-the-shelf 'ping' program a whole whack of times to stimulate ARP responses from as many remote nodes is required. Remember that there won't be any entries in the ARP table unless the machine your on hasn't had to communicate with anyone. The ARP entries also expire after a period of time, though it is at least a few minutes.

    Then you can read the ARP table directly from your system (i.e. /proc/arp) or by using the 'arp' program which will give you something like:
    ? ( at 00:E0:29:25:7A:46 [ether] on eth0 ? (24.114.X.X) at 00:01:64:A5:F9:00 [ether] on eth1
    Once you've got the MAC address, you can do a few lookups to find out who might have made that gear. Each "vendor" is allocated a unique three-octet beginning, so you can guesstimate what that device is by this data.

    The trick is to find a comprehensive table of registrations. The IANA (Internet Assigned Numbers Authority) is supposed to do this, but their material is out of date even though they are the ones who issue numbers. Can you believe they have a "gopher://" URL in that file? Yikes.

    The IEEE seems to have a pretty good, parsable file at here. See if that's to your liking.
Re: MAC Address and NIC Device on Network.
by vladdrak (Monk) on Jun 27, 2001 at 05:27 UTC
    There is a Resource Kit utility called getmac.exe that can prove useful. You'll want to either compile a list of the machines you want to check, or enumerate an NT domain to check those machines. You could also walk IP addresses if you don't have a network browse list built up. Anyways, your code might be:
    my @machines=("host1","host2","host3"); my %macs=(); for my $machine (@machines) { my $macraw=`getmac $machine`; if ($macraw =~ /(match something)/) { $macs{$1}=$machine; } } print "$macs{$_} $_\n" for (keys %macs);
    Which would fill $macraw with something like this:
    Transport Address Transport Name ----------------- -------------- 00-00-00-00-00-00 \Device\NetbiosSmb 00-A0-B0-6C-38-D0 \Device\NetBT_El90x1
    ..which you'll clean up with the regex buffer, and then toss it in a hash. The NetBT_El90x just identifies the interface as a 3Com 9xx card. Intels show as E100b, Compaq NetFlex as NetFlx, etc. In Win2k the identifer is actually a GUID that maps back to the driver/service name (joy!). If you have a good idea of what NICs are on your LAN it makes it easier.. you'll probably want to do a dirty scan first on everything, then refine your regex.

    Good Luck,
Re: MAC Address and NIC Device on Network.
by admiral llama (Initiate) on Jun 27, 2001 at 06:51 UTC
      All boxen that implement the TCP/IP protocol must respond. Even windows machines manage it.

      You can catch the return packets with Net::Packet (Update: It's NetPacket, not Net::Packet, available from CPAN, runs under windows with the pcap library), if you have root access. I have a little proggie that does this if you are interested. Actually it sits there and silently matches ethernet addresses to IPs, and identifies gateways and routers from that data.

      For extra humour during a boring afternoon, ping flood the broadcast address and watch the network admin go into spasms.

      I didn't believe in evil until I dated it.

        Or just parse `arp -a`.

        Update: The original question seems clearly to be about Windows, which does come with "arp" (I think Win2K was mentioned in the chatterbox). Your mention of "root access" makes me wonder whether Net::Packet will work on Win2K, but I don't find it on CPAN so I didn't go any further trying to check that out.

        I didn't say the method that I mentioned was the only way, of course.

        Update2: Thanks for the clarifications, jepri. I can still roll code to parse `arp -a` faster than I can download NetPacket and pcap much less install them and get them working (heck, nearly faster than I can find NetPacket given how slow is these days). So if all I'm interested in the MAC addresses, I'll stick with arp output unless I've already gotten NetPacket working for other reasons.

        But I didn't reply to criticize your suggestion. I just waited a while and noted that no one else had mentioned "arp -a" yet so I thought it should be part of the thread. So I decided to post it in reply a node that mentioned something acurate and your fact about all TCP/IP stacks having to support ARP won. (:

                - tye (but my friends call me "Tye")
      That's something to be careful with - anyone who pulled a stunt like that on my network would get the plug pulled on their connection in a heartbeat, and not just because it happens to be the first step of several DoS attacks. It's also not the most reliable method:
      • A machine's arp cache is only of finite size, so you can only capture so many addresses
      • Since every machine will be answering all at once, there's a very good chance that some of the replies will just get dropped
      • Any machines that are behind a router, will simply appear with the routers mac address if the router even passes the packet at all.
      The approach of running a prog on each station that reports back the mac to a central server is probably the most reliable and network-friendly way to go.

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: perlquestion [id://91777]
Approved by root
[davido]: Lol, in composing test code for Re: Stupid, yet simple, sort question I managed to fill up /tmp for a moment, causing bash to complain about "pmbash: cannot create temp file for here-document: No space left on device"
[davido]: hm, sorry, wrong link: Re^3: Perl Program to efficiently process 500000 small files in a Directory (AIX) should be it.

How do I use this? | Other CB clients
Other Users?
Others about the Monastery: (2)
As of 2018-03-18 06:59 GMT
Find Nodes?
    Voting Booth?
    When I think of a mole I think of:

    Results (228 votes). Check out past polls.