Projects Log

« Previous—Next »

How to get the MAC address of a remote computer with its IP address with perl

1 August 2006

Windows >= 2000 only (or maybe NT4.0 SP6)

This is the cool solution, or you could parse the result of `ping -n 1 $ip > nul & arp -a` searching for $ip in the list (very slow and unpretty solution btw)

We will use two Windows dll ( iphlpapi.dll and wsock32.dll ) to import two functions ( SendARP and inet_addr );
to do that, we will need Win32::API perl module.
if you have some error like "Can't locate Win32/API.pm in @INC…" when you try to run the script, you need to install it:
type: ppm install Win32-API in a dos prompt.

What is ARP?

Address Resolution Protocol (ARP) is a required TCP/IP standard defined in RFC 826, "Address Resolution Protocol (ARP)." ARP resolves IP addresses used by TCP/IP-based software to media access control addresses used by LAN hardware. ARP provides the following protocol services to hosts located on the same physical network:

Media access control addresses are obtained by using a network broadcast request in the form of the question "What is the media access control address for a device that is configured with the enclosed IP address?"

When an ARP request is answered, both the sender of the ARP reply and the original ARP requester record each other's IP address and media access control address as an entry in a local table called the ARP cache for future reference.

Source: microsoft.com

In other words, ARP is a protocol used to translate IP addresses to MAC (physical) addresses.

As you can see, this looks pretty simple, one question (frame 1), and one answer (frame 2)

In order to improve performances, and to lower network charge, the data are cached locally.
You can access (read/write) the ARP cache data with the arp command:
for example: arp -a displays every ARP entries.
You may need to ping the computer before.

Well, the code now (192.168.0.254 is just an example):

[The requested file http://dev.pulsed.net/wp/code/arp.pl could not be found]

The best part of this little script is (what i thought impossible in perl) the dll function import!

2 Responses to “How to get the MAC address of a remote computer with its IP address with perl”

1. Nils Says:
   May 8th, 2007 at 8:29 pm

   use Win32::API;
   use strict;
   my $SendARP = new Win32::API("IPHLPAPI", "SendARP", "NNPP", "N");

   if(not defined $SendARP) {
   die "Kan de API SendARP niet gebruiken/vinden: $!\n";
   exit;
   }

   my $inet_addr = new Win32::API("wsock32", "inet_addr", "P", "N");
   if(not defined $inet_addr) {
   die "Kan de API inet_addr niet gebruiken/vinden: $!\n";
   exit;
   }

   my $mac=pack('CCCCCC',0);

   print "Gebruik e of exit als IP om te stoppen.\n";

   while(1) {
   print "IP? ";
   my $ip_address = ;
   chomp($ip_address);
   $ip_address =~ tr/A-Z/a-z/;
   print "—————–\n";
   if($ip_address eq 'e' or $ip_address eq 'exit' or $ip_address eq 'quit') { last }
   if($SendARP->Call($inet_addr->Call($ip_address),0,$mac,pack('L',6))==0) {
   my $mac_address=join ":", map {uc sprintf("%02lx", $_%256 )} unpack('CCCCCC',$mac);
   print "IP: $ip_address\n";
   print "MAC: $mac_address\n";
   print "—————–\n\n";
   } else {
   print "Geen antwoord van $ip_address";
   print "—————–\n\n";
   }
   }

   print "Danku om IP2MAC te gebruiken!";

   ——
   It's in dutch but, whatever!
   I have made the arp.pl script a little better, now it asks for the IP if you run the script. It also has an infinite loop(unless you use the option e, exit or quit) so you can always keep IP2MAC' ing!

2. Dr.FarFar Says:
   May 21st, 2008 at 2:58 pm

   Thanks Bro …