Re: How to detect my own MAC address from outside Internet (!) (NOT with ipconfig all)

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance



"Jim" <j.n@xxxxxxxxxx> wrote in
news:Sxrqj.12844$EZ3.3933@xxxxxxxxxxxxxxxxxxxx:

That is most interesting information Chuck...
Back when I was working for a living, I maintained an ethernet
sniffer for VMS which ran DECnet. Regardless of that fact, my
sniffer detected every computer on our segment of the
plant wide ethernet without regard to the network protocol that it
was using. I understood at the time that all ethernet adapters
are expected to broadcast their address at
regular intervals. My program placed the ethernet adapter on our
VAX into promiscuous mode (which causes the adapter to pass all
packets to the software). A VAX had a hard time keeping up; when
I ported the program over to an Alpha, things worked much better.

I suppose my point is that a program can be written which grabs
all packets which pass by without regard to whatever structure the
IP believes it has. By the way, DECnet and IP can coexist on the
ethernet with no problems at all.


The MAC address exists at the lowest levels of the protocol stack and
is used as an outer wrapper to deliver a packet directly from one
device to another. If the destination device is a Router/Gateway, that
device then strips off the Ethernet wrapper and replaces it with one of
its own that sends the packet from that gateway to the next. All
traces of the original MAC address are lost at that point. A long time
ago, subnets were larger and broadcasts (like ARP) used to traverse
routers. Now, it is rare for a broadcast packet to survive past a
gateway.

Switches have now limited the amount of packets visible at an end
device to where promiscuous mode is almost moot. The only practical
way to find the MAC address of a device not on your subnet is to send a
packet to that device asking for it to reply with its MAC address.
That implies that a program or service is running on the target machine
that will willingly report that information. As part of the NetBT
service, Microsoft has provided that information by way of the
"nbtstat" program in which the target machine will report back its MAC
address among other info. Doing a remote registry query to the target
machine might be another way.

-- John
.



Relevant Pages

  • Re: IP6 addresses in my routing table
    ... the routing table for my second computer. ... MAC addresses because this is how Ethernet works. ... on the front of the Ethernet packet. ...
    (comp.unix.bsd.openbsd.misc)
  • Re: Sniffer Cant see cluster traffic
    ... > protocol and cluster specific multicast MAC address, ... > node specific source MAC address. ... > is a multi-cast packet or a directed packet. ... Yep and that is solely at the ethernet packet level. ...
    (comp.os.vms)
  • Re: ARP - IP but why?
    ... Resolution Protocol and it matches up network addresses with hardware ... If you have a static IP address on an Ethernet network, ... ever need to translate the IP address to a MAC address? ... It sends out an ARP packet asking "who's got 192.168.0.1?", and the router replies with its MAC address. ...
    (comp.os.linux.networking)
  • Re: IP6 addresses in my routing table
    ... is for my second computer, not the computer connected directly to the ... MAC addresses because this is how Ethernet works. ... on the front of the Ethernet packet. ...
    (comp.unix.bsd.openbsd.misc)
  • Re: How to detect my own MAC address from outside Internet (!) (NOT with ipconfig all)
    ... and routers and I guess at least one of them is modifying my original MAC ... plant wide ethernet without regard to the network protocol that it was ... I understood at the time that all ethernet adapters are expected to ... which pass by without regard to whatever structure the IP believes it has. ...
    (microsoft.public.windowsxp.network_web)