I'm looking for some Linux code to find an IP address from an Ethernet address. I suppose I have to do some inverse ARP trickery but I don't find any example...
Asked
Active
Viewed 5,821 times
3
-
do you mean you want an ip from a mac ? – pablochan Mar 20 '10 at 22:54
-
@Fred: when you say, "Linux code", do you mean code in a programming language? What language? – John Saunders Mar 20 '10 at 23:01
-
An Ethernet address is a MAC address, so yes - you'd need to use ARP/RARP to translate between MAC and IP address. – OMG Ponies Mar 20 '10 at 23:58
-
Yes IP from MAC in whatever language. I'll adapt it to my need. – Fred Mar 21 '10 at 06:01
3 Answers
3
http://compnetworking.about.com/od/networkprotocolsip/f/convertipmacadd.htm
Try sending an IP broadcast (e.g. ping 192.168.1.255 if your subnet is 192.168.1.0/24) to prime your ARP cache, followed by arp -a to spit it all out.
vladr
- 65,483
- 18
- 129
- 130
2
For computers that you have communicated with, you can look at their arp entry. This is available in text format in /proc/net/arp for example. Finding an IP address for a MAC that you know but haven't communicated with is significantly more difficult. The closest match, protocol-wise, would be RARP but that's hardly ever in use so your are not likely to get a response.
You can always scan your local subnet to make sure you get a full view in your arp table. See for example fping for an efficient way to do this. Note that hosts don't actually need to respond to the pings in question to appear in the ARP table, so this is useful even in the presence of local firewalls etc.
Jakob Borg
- 23,685
- 6
- 47
- 47
-
@calmh ok so there is no other way. Is it better to send ICMP packets with ping or fping or to use something like arping ? – Fred Mar 21 '10 at 06:10
-
Arping would be more efficient, since it avoids the ICMP step that is unnecessary for your purposes. But overall, fping might be faster since it parallellizes more and is actually made for scanning a subnet quickly. The best would probably be to quickly send arp questions yourself, like arping does. Make one thread send requests as quickly as possible (or with a reasonable rate limit) and another thread listen for incoming responses. That way you could probably get a complete picture of a /24 subnet in a few seconds. – Jakob Borg Mar 21 '10 at 10:16
0
Take a look at Thomas Habet's Arping. I've not tried it, but the basic idea is to send an ICMP Ping network packet to the MAC address in question using a broadcast destination IP address in the IP header. Only the host with the specified MAC address will reply and the reply will (usually) contain its IP address. It won't always work but it might be good enough for you. See the project readme for limitations.
Ian Goldby
- 5,609
- 1
- 45
- 81
-
Please [avoid link only answers](http://meta.stackoverflow.com/tags/link-only-answers/info). Answers that are "barely more than a link to an external site” [may be deleted](http://stackoverflow.com/help/deleted-answers). – Quentin Apr 04 '18 at 10:04
-
1@Quentin This isn't a link-only answer. It describes in outline the technique used by Arping. – Ian Goldby Apr 04 '18 at 11:10