AW: Getting an IP address from a MAC address

From: Meidinger Chris (chris.meidinger_at_badenit.de)
Date: 07/09/03

  • Next message: check: "FW: Questions about 192.168"
    To: "Security-Basics@Securityfocus. Com (E-Mail)" <security-basics@securityfocus.com>
    Date: Wed, 9 Jul 2003 14:00:47 +0100 
    
    

    if you are in a windows environment, nbtstat -c -a NetBIOS_Name will provide
    you with the remote NetBIOS table and MAC Address.

    Not sure if someone mentioned this before, i was only skimming the thread. I
    just ran across this doing an nbtstat and remembered that people had been
    talking about mac addys and wanted to mention that i noticed this.

    badenIT GmbH
    System Support
     
    Chris Meidinger
    Tullastrasse 70
    79108 Freiburg

    -----Ursprüngliche Nachricht-----
    Von: Sanjay Arora [mailto:skpobox@yahoo.com]
    Gesendet: Saturday, July 05, 2003 5:25 PM
    An: security-basics@securityfocus.com
    Betreff: Re: Getting an IP address from a MAC address

    Pinging a broadcast address would get Linux/Unix
    Machines on the local net to respond...how to go about
    getting the Windows machines to respond? Is there any
    other way than a ping sweep, which would make the
    ghost/lurker suspicious, if he is firewalling and
    running ids software.

    --- Dana Epp <dana@vulscan.com> wrote:
    > Have you considered using arp and simply checking
    > your arp tables?
    >
    > If you are on the same net, you can do a single ping
    > to the broadcast to get
    > every card to respond, and then do something like:
    >
    > arp -a | grep <mac>
    >
    > Where <mac> is the MAC addr you are looking for.
    > Note that on windows each
    > octet is separated by a dash, and on most unix' its
    > a colon.
    >
    > ie (using an example of a 192.168.1.0 class C
    > block):
    >
    > Windows:
    > ping -n 1 192.168.1.255
    > arp -a | grep 00-00-00-00-00-00
    >
    > Unix:
    > ping -c 1 192.168.1.255
    > arp -a | grep 00:00:00:00:00:00
    >
    > You might want to put a delay/sleep in there after
    > the ping to give the
    > network chatter enough time to respond. Otherwise
    > that will do what you
    > want.
    >
    > Good luck.
    >
    > ---
    > Regards,
    > Dana M. Epp
    >
    >
    > ----- Original Message -----
    > From: <Steven_Paice@cityofperth.wa.gov.au>
    > To: <security-basics@securityfocus.com>
    > Sent: Monday, June 30, 2003 10:54 PM
    > Subject: Getting an IP address from a MAC address
    >
    >
    > > Hi all,
    > >
    > > I was wondering if anyone knows of a tool which
    > can determine an IP
    > address
    > > from a MAC address???
    > > I have found plenty of tools which will work the
    > other way, but nothing
    > for
    > > what I am after.
    > >
    > > Thanks in advance
    > > Steven P
    > >
    > >
    > >
    >
    --------------------------------------------------------------------------
    > -
    > > Evaluating SSL VPNs' Consider NEOTERIS, chosen as
    > leader by top analysts!
    > > The Gartner Group just put Neoteris in the top of
    > its Magic Quadrant,
    > > while InStat has confirmed Neoteris as the leader
    > in marketshare.
    > >
    > > Find out why, and see how you can get plug-n-play
    > secure remote access in
    > > about an hour, with no client, server changes, or
    > ongoing maintenance.
    > >
    > > Visit us at:
    > http://www.neoteris.com/promos/sf-6-9.htm
    > >
    >
    --------------------------------------------------------------------------
    > --
    > >
    >
    >
    >
    ---------------------------------------------------------------------------
    > Evaluating SSL VPNs' Consider NEOTERIS, chosen as
    > leader by top analysts!
    > The Gartner Group just put Neoteris in the top of
    > its Magic Quadrant,
    > while InStat has confirmed Neoteris as the leader in
    > marketshare.
    >
    > Find out why, and see how you can get plug-n-play
    > secure remote access in
    > about an hour, with no client, server changes, or
    > ongoing maintenance.
    >
    > Visit us at:
    > http://www.neoteris.com/promos/sf-6-9.htm
    >
    ----------------------------------------------------------------------------
    >

    __________________________________
    Do you Yahoo!?
    SBC Yahoo! DSL - Now only $29.95 per month!
    http://sbc.yahoo.com

    ---------------------------------------------------------------------------
    Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts!
    The Gartner Group just put Neoteris in the top of its Magic Quadrant,
    while InStat has confirmed Neoteris as the leader in marketshare.
         
    Find out why, and see how you can get plug-n-play secure remote access in
    about an hour, with no client, server changes, or ongoing maintenance.
              
    Visit us at: http://www.neoteris.com/promos/sf-6-9.htm
    ----------------------------------------------------------------------------

    ---------------------------------------------------------------------------
    Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts!
    The Gartner Group just put Neoteris in the top of its Magic Quadrant,
    while InStat has confirmed Neoteris as the leader in marketshare.
         
    Find out why, and see how you can get plug-n-play secure remote access in
    about an hour, with no client, server changes, or ongoing maintenance.
              
    Visit us at: http://www.neoteris.com/promos/sf-6-9.htm
    ----------------------------------------------------------------------------


  • Next message: check: "FW: Questions about 192.168"