Ethereal-users: Re: [Ethereal-users] Resolve MAC addresses

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Craig Pratt <craig@xxxxxxxxxxxxx>
Date: Fri, 18 Jan 2002 12:34:58 -0800 (PST)
On Fri, 18 Jan 2002 mabj@xxxxxxxxxxxxxx wrote:
> Hello.
>
> Does anyone know a way to resolve a MAC address to IP address?
> I'm using a win32 OS.
>
> /Martin

I don't know if it's on all versions, but W2000 has an "arp"
command that works like like the Unix version (i.e. operates on
the local machine's ARP table).

You could use the arp program to determine the MAC from an IP
like this:

P:\>arp -a

Interface: 10.9.253.28 on Interface 0x2
  Internet Address      Physical Address      Type
  10.9.253.122          00-c0-4f-68-94-18     dynamic
  10.9.253.251          00-01-64-75-2c-54     dynamic

P:\>ping 10.9.253.134

Pinging 10.9.253.134 with 32 bytes of data:

Reply from 10.9.253.134: bytes=32 time<10ms TTL=128
[chomp]

P:\>arp -a

Interface: 10.9.253.28 on Interface 0x2
  Internet Address      Physical Address      Type
  10.9.253.122          00-c0-4f-68-94-18     dynamic
  10.9.253.134          00-d0-b7-01-26-e8     dynamic
  10.9.253.251          00-01-64-75-2c-54     dynamic

Note the new entry in the ARP table from the ping. Also note that
you can only get MAC addresses for machines on the same
LAN/subnet. This is the nature of ARP.

The RARP (resolving the IP from the MAC) is another matter. And
it will have the same LAN limitiation.

There are tools out there for Win32 systems (may be considered
hacking tools) that can do more - again with the above
restriction. But they will certainly require raw socket support.
Hence, they would not run on Win9x/ME. And there might be
security requirements on a WinNT system (W2000, WinXP), if MS was
doing things the right way.

Craig