-2

I've got a computer with two network adapter, both of them is assigned a different IP.(EX:192.168.81.90, 192.168.81.93)

And I use ARP scan from 192.168.81.1 to 192.168.81.255, I will get two different MAC addresses and two different IPs.

Is it possible to recognize these pairs of MAC address + IP belonging to the same host?

Zac67
  • 2,761
  • 1
  • 10
  • 21
Drunk Engineer
  • 11
  • 6

2 Answers2

1

"Is it possible to recognize these pairs of mac address + IP belong to the same host?" - No, that's not possible unless there's a higher layer protocol providing this information. You can't go by IP address and MAC alone.

Zac67
  • 2,761
  • 1
  • 10
  • 21
0

I can propose you a test, but It will not be successful in all cases. It will depend on the OS IP stack implementation. You did not give us a important information about your setup, that is your network mask. I suppose your question is related to a host with 2 different IP on the SAME network. You have to know first, that setup is a WRONG setup because it creates a asymmetric load for outgoing traffic. If a host has 2 physical interfaces on the same IP network (same network number, same netmask), you MUST first bond both interface at level 2 to create one virtual interface to assign it the 2 IP addresses. The test I propose you, is to detect that wrong setup: Let's suppose for 192.168.81.90 you got 01:01:01:01:01:01 mac address, and for 192.168.81.93 you got 02:02:02:02:02:02 (result got from you scan). Manually, with the arp command, swap the mac of both ip with command like: arp -s 192.168.81.93 01:01:01:01:01:01 arp -s 192.168.81.90 02:02:02:02:02:02

With that arp (temporary) setup, now try to ping each ip. If you got a echo reply, both ip COULD (not yet sure) be on the same host. The final verification is to grab the echo reply packet with tcpdump, and to verify its source mac @ and to check is either 01:01:01:01:01:01 or 02:02:02:02:02:02. If the mac address source is not one of these addresses, so, the host your are testing is a router and not a host. (the system is forwarding the traffic and not only receiving it like a host) A case where my test fails is when the host has IP filtering on incoming interfaces.

Stéphane Le Men
  • 137
  • 3
  • A host with two interfaces in the same subnet is a completely valid setup. Naturally, you have to know what you're doing - as always. Your temporary static ARP & ping test has the additional problems that you can't know which pair of IP addresses belong together and that a host may not send an echo reply at all. – Zac67 Nov 14 '17 at 16:29