Programatically retrieve MAC and IP addresses from my local network

[Paul_51]

Good morning,

I've been around a number different sites trying proposed solutions both in C and VB but have not been successful. Most solutions give only those devices connected to my computer. Am I missing something, my router can do (but it's a pain to extract all the MACs and IPs). I've to established a baseline of the MACs on my network now I'd like to run a program (monthly) that extracts currently connected devices so I can validate their MACs against my baseline. The closest solution was in C but I'm not able to convert it to work in Visual Studio 2015 (VB). Any help will be greatly appreciated.

Thank you,
Paul Blair

[rproffitt]

I feel you are working too hard. I recall doing this with PING and ARP (see google if you forgot how.) And maybe NIRSOFT has an app as noted at http://www.howtogeek.com/tips/how-to-quickly-get-the-mac-address-of-any-windows-pc-on-your-network/

The reason you most likely failed is that computers on your network don't send you traffic. That is, your switch doesn't show you all traffic so you can't pick the information off that way. You'll have to ping machines and hopefully the ARP cache will fill or you can use arp directly.

Sorry no, not an offer to write a tutorial on IP commands.

[Paul_51]

Thank you for your response. I've seen programatic solutions done C so I know that it can be done, even if I have to "loop" through 256 (0-255) I/P addresses on my local network. I have also seen where using a specific I/P on a given network can return a description and a MAC. So, I will wait for more responses hoping someone has done this without having to do a ping and arp 256 times.

Thank you again for reading my post.

[rproffitt]

Sorry but all skill levels arrive here. So there is a specific ping that gets replies from all on the LAN. Do you remember your IP networking class on that?

Also, what's wrong with looping?

And why not have the router's own log do this for us?

[Paul_51]

Good morning and again, thanks for your reply. There is nothing wrong with looping as long as it's done programatically.

My household has 17 devices that may or may not be on the home network. I have identified the MAC addresses of each and created a file consisting of these MACs and an identifier (i.e. ff:ff:ff:ff:ff:ff // ROKU_TV, ff:ff:ff:ff:ff:ff // John_Cell, etc.) Processing the results of the ping and arp -a commands, running them against this table of "known" MACs and identifying any MAC from the arp -a command that is not in this table was the goal.

After borrowing, pasting and assembling my VS 2015 (VB) code, I have successfully accomplished this. Yes, I'm aware that MAC addresses can be changed but for now, I feel comfortable that I can show a device on my network that is not known to me.

Basically, 1 arp -a to pick up the Interface ID, 1 ping of x.x.x.255 to get all devices and a final arp -a to acquire all MACs.

All I needed was sample VB code to get this programatic interface done.

Thank you for being there.

[cereal]

Check arp-scan -ln it outputs something like this:

> arp-scan -ln
Interface: wls1, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.8.1 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)
192.168.0.1     00:c0:9f:09:b8:db       QUANTA COMPUTER, INC.
192.168.0.5     00:02:a5:90:c3:e6       Compaq Computer Corporation
192.168.0.87    00:0b:db:b2:fa:60       Dell ESG PCBA Test
192.168.0.90    00:02:b3:06:d7:9b       Intel Corporation
192.168.0.153   00:10:db:26:4d:52       Juniper Networks, Inc.
192.168.0.191   00:01:e6:57:8b:68       Hewlett-Packard Company
192.168.0.196   00:30:c1:5e:58:7d       HEWLETT-PACKARD

7 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.8.1: 256 hosts scanned in 1.628 seconds (157.25 hosts/sec). 7 responded

And you could simply parse the output. But I'm not sure if there is a version for Windows platforms. Some info here:

• https://github.com/royhills/arp-scan

[Paul_51]

Thank you again, rproffitt. Actually, with arp -a, i get something like that now (with a little clean-up and some assumptions.) Windows does not support arp-scan :( (I didn't look deeply into this; I have really overworked this now, you're first comment.)

I'm going to close this thread. Thanks for your help.