Get mac address of connected TCP client

[james3mg]

Hey all,

I'm trying to figure out a better method than IP addresses to try and uniquely identify client computers connected to my script via TCP...I'd like to be able to find the mac address of the client whenever a socket is connected. I know that mac addresses can be easily spoofed, but it's better than IP addresses which are nearly guaranteed to change

I'm sure it's got to be available somehow, since mac addresses are a key component to how TCP packets get to their destination, but I'm not sure if/how it may be exposed at the script level. I'm sure it'll take a DLL struct like the GetIP functions floating around on the forums, but I sure as heck don't know what!

Thanks

[PsaltyDS]

Hey all,

I'm trying to figure out a better method than IP addresses to try and uniquely identify client computers connected to my script via TCP...I'd like to be able to find the mac address of the client whenever a socket is connected. I know that mac addresses can be easily spoofed, but it's better than IP addresses which are nearly guaranteed to change

I'm sure it's got to be available somehow, since mac addresses are a key component to how TCP packets get to their destination, but I'm not sure if/how it may be exposed at the script level. I'm sure it'll take a DLL struct like the GetIP functions floating around on the forums, but I sure as heck don't know what!

Thanks

Run("arp -a " & @IPAddress1 & " > C:\Temp\ArpData.txt")

If you feel geeky, you could catch the output with $STDOUT_CHILD and StdOutRead().

[james3mg]

Run("arp -a " & @IPAddress1 & " > C:\Temp\ArpData.txt")

If you feel geeky, you could catch the output with $STDOUT_CHILD and StdOutRead().

OK, never used ARP, so forgive me if I don't understand.

Let's say I run this script:

TCPStartup()
$ListenSocket=TCPListen("0.0.0.0",80)
While 1
  $socket=TCPAccept($ListenSocket)
  If $socket < 0 OR @error Then ContinueLoop
  $recv=""
  Do
    $tmp=StringLen($recv)
    $recv&=TCPRecv($socket,1024)
  Until $tmp=StringLen($recv) AND $tmp>0 AND StringRight($recv,1)=@LF
  ConsoleWrite($recv);proves the client is connected, has sent data, and is waiting for data to be sent back
  MsgBox(0,"hi","Script is paused...run arp!");stops the script in its' tracks so the client stays connected)
  TCPCloseSocket($socket)
WEnd

Now I navigate to http://localhost, or navigate to http://[ipaddress] from another machine on the network. When the message box pops up, I have an active TCP client connected through a socket. I want to find the mac address of this client, so I open up a commandline window and type "arp -a 10.1.1.100". I see, "No ARP entries found". If I just run "arp -a", I see a bunch of entries, but they all refer to stuff on MY machine, not the client's.

What am I doing wrong?

Edited March 13, 2009 by james3mg

[PsaltyDS]

OK, never used ARP, so forgive me if I don't understand.

Let's say I run this script:

TCPStartup()
$ListenSocket=TCPListen("0.0.0.0",80)
While 1
  $socket=TCPAccept($ListenSocket)
  If $socket < 0 OR @error Then ContinueLoop
  $recv=""
  Do
    $tmp=StringLen($recv)
    $recv&=TCPRecv($socket,1024)
  Until $tmp=StringLen($recv) AND $tmp>0 AND StringRight($recv,1)=@LF
  ConsoleWrite($recv);proves the client is connected, has sent data, and is waiting for data to be sent back
  MsgBox(0,"hi","Script is paused...run arp!");stops the script in its' tracks so the client stays connected)
  TCPCloseSocket($socket)
WEnd

Now I navigate to http://localhost, or navigate to http://[ipaddress] from another machine on the network. When the message box pops up, I have an active TCP client connected through a socket. I want to find the mac address of this client, so I open up a commandline window and type "arp -a 10.1.1.100". I see, "No ARP entries found". If I just run "arp -a", I see a bunch of entries, but they all refer to stuff on MY machine, not the client's.

What am I doing wrong?

You need to run that on the machine you want the MAC address for. Alternatively, you could use WMI to connect remotely and pull the MAC from the remote interface object. Either way, you need perms to run something on the remote machine.

Now, this assumes the other machine is not on your local network segment (which it must not be if it didn't show up in your local ARP table). If you simply send an ARP request for the IP address, the MAC you get back will be from your router's gateway interface, because that is the next hop towards reaching the remote IP. You can't ignore all the other interfaces (ISP routers, etc.) between your computer and the remote, and just get the MAC on the remote machine with an ARP request.

Layer 2 addressing (MAC) is only intended for use within the local network segment. It is not meant to be "routed". That gets done by layer 3 (IP addressing).

[james3mg]

You need to run that on the machine you want the MAC address for. Alternatively, you could use WMI to connect remotely and pull the MAC from the remote interface object. Either way, you need perms to run something on the remote machine.

Now, this assumes the other machine is not on your local network segment (which it must not be if it didn't show up in your local ARP table). If you simply send an ARP request for the IP address, the MAC you get back will be from your router's gateway interface, because that is the next hop towards reaching the remote IP. You can't ignore all the other interfaces (ISP routers, etc.) between your computer and the remote, and just get the MAC on the remote machine with an ARP request.

Layer 2 addressing (MAC) is only intended for use within the local network segment. It is not meant to be "routed". That gets done by layer 3 (IP addressing).

Hmmm...I must have had the wrong idea of mac addresses- I thought that was how TCP/IP traffic found the ultimate end point. What you say makes sense though. I'll look for something else

Thanks