Re: get IP from MAC address

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

From: Alan J. McFarlane (alanjmcf_at_yahoo.com.INVALID)
Date: 09/03/04 

Date: Fri, 3 Sep 2004 18:57:22 +0100

Chris <none@sorry> wrote:
> attribution lost:
>> attribution lost:
>>> Is there any way i can get IP address from MAC ? ( it`s
>>> for small LAN only so it doesn`t matter if it`ll be MAC
>>> from IP )
>>>
>> You need to use RARP or Reverse Address Resolution Protocol. This
>> does not use Netbios, however you have to have TCP/IP for it to work.
>
Here's a paragraph I posted to a previous such question.

And to the OP there's no useful way to do this. There certainly is no IETF
protocol for this--it's not an operation useful to networking. So you could
sniff the traffic until the MAC Address appears. Or send traffic to every
host on your local LAN segment and see if the MAC Address appears in your
ARP table. Or for remote hosts maybe use SNMP or WMI or something to get
their MAC Addresses. If you are using DHCP for address assignment just
check its database for the MAC Address.

> That's not right. RARP is used for diskless workstations to request
> its own IP address. It will broadcast an RARP request and a RARP
> Server will wait for such requests and reply. It's line DHCP.
>
This bit I like, I was just going to post a message saying the same. I
don't know where this incorrect rumour about RARP's use comes from; just
from its name maybe? :-( AAUAPF--Address Assignment using ARP Packet Format
might have been better. :-,)

> In the case of you will need InverseARP. It is documented in RFC2390.
> As far as I know there there is no Windows API for this. You can use
> librarys such as libcap or winpcap for this. Inverse ARP has the same
> packet format as ARP.
>
This bit I like less. INARP is only useful (and usable) on NBMA
(Non-Broadcast Multi-Access) networks (with Virtual Circuits) that don't
have Layer 2 protocol addresses. And its function is not that required here
anyway. See RFC 2390 for details. 

-- 
Alan J. McFarlane
http://homepage.ntlworld.com/alanjmcf/
Please follow-up in the newsgroup for the benefit of all.

Relevant Pages

  • Re: general sniffer question
    ... It is possible that what you saw was ARP broadcasts, ... communication protocol, they need the MAC address of each card, an ip ... > other peoples packets that are not broadcast packets. ...
    (Security-Basics)
  • Re: NDIS driver MiniportSend doubt
    ... The packet you want to send is an ARP request, ... FF FF FF FF FF FF Destination MAC address ... it uses the ARP (Address Resolution ... Protocol) to do that. ...
    (microsoft.public.windowsce.platbuilder)
  • Re: RARP
    ... What I am trying to get at is that in Netmon in shows me the MAC addresses ... I got around this by looking in my Cisco Router arp ... > Any book that explains ARP and RARP on the same ... > very similiar packet type and they rhyme. ...
    (microsoft.public.win2000.networking)
  • Re: Sniffer Cant see cluster traffic
    ... > protocol and cluster specific multicast MAC address, ... > node specific source MAC address. ... > is a multi-cast packet or a directed packet. ... Yep and that is solely at the ethernet packet level. ...
    (comp.os.vms)
  • Re: Reduce ARP Traffic
    ... We discovered we had a lot of Spanning Tree Protocol traffic ... lot lf ARP request traffic. ... You have a brigde to another network? ... 2)Create a simple static IP network between 1 client and the server - ...
    (microsoft.public.windows.server.networking)