<< XKCD today just made me choke on my water | Home | Retrieve Remote MAC Address in PowerShell >>

How to Retrieve Remote MAC Address Programmatically

The question often comes up, how do you find out the MAC address of a remote machine, given its IP address?  There are a few ways to do it, but here are two:

  1. The first way is to use SNMP.  Use whatever SNMP library you like, or create your own.  Here are the steps you'll need to take, as well as an example showing how to implement these steps using IP*Works! or IPWorks Secure SNMP.

    • Get the number of interfaces on the device (ifEntryNum - 1.3.6.1.2.1.2.1)
    • For each interface, get the MAC address (ifPhysAddress - 1.3.6.1.2.1.2.2.1.6).  You can also determine a lot of other information about the interface (the ifEntry table has several children) including the type of the device  (ifEntryType - 1.3.6.1.2.1.2.2.1.3).

    Example:

    snmpmgr1.Timeout = 10;
    snmpmgr1.RemoteHost = "10.0.1.11";
    	    
    snmpmgr1.ObjCount = 1;
    snmpmgr1.ObjId[1] = "1.3.6.1.2.1.2.1"; //ifEntryNum snmpmgr1.SendGetNextRequest();
    int ifindex = Convert.ToInt32(snmpmgr1.ObjValue[1]);
    textBox1.AppendText("Number of interfaces: " + snmpmgr1.ObjValue[1] + "\r\n");

    snmpmgr1.ObjCount = 2;
    snmpmgr1.ObjId[1] = "1.3.6.1.2.1.2.2.1.3"; 
    //ifEntryType, this is "6" for an ethernet adapter, "24" for loopback interface 
    //For a full list see rfc 1573
    snmpmgr1.ObjId[2] = "1.3.6.1.2.1.2.2.1.6"; //ifPhysAddress 
    for (int i = 1; i<= ifindex; i++)
    {
      snmpmgr1.SendGetNextRequest();
      textBox1.AppendText(i.ToString() + ".  Type " + snmpmgr1.ObjValue[1]);
      string hexval = "";
      for (int j = 0; j< snmpmgr1.ObjValueB[2].Length; j++)
      {
        hexval = hexval + snmpmgr1.ObjValueB[2][j].ToString("X") + " ";
      }
      textBox1.AppendText(", MAC address: " + hexval + "\r\n");
    }
  2. The second way requires the use of the IPWorks IPInfo component, which has a GetMAC method.  This method takes an IP address as its argument and returns a string, which is the MAC address of the device at the remote IP.  Example:
    string macaddress = IPInfo1.GetMAC("10.0.1.11");
    //macaddress will now contain a string of the form "00-04-00-d7-90-d8"

Print | posted on Monday, August 20, 2007 5:26 PM

Feedback

# re: How to Retrieve Remote MAC Address Programmatically

Left by Shay Levi at 8/20/2007 6:45 PM
Gravatar Here's another way, posted it on my blog.
BTW, I like your logo ;)

function Get-MacAddress{

param( [string]$ip= $(throw "Please specify IP number") )

arp -d; # clear arp cache
$ping = (new-object System.Net.NetworkInformation.Ping).Send($ip);
if($ping){
($mac | ? {$_ -match $ip}) -match "([0-9A-F]{2}([:-][0-9A-F]{2}){5})" | out-null;
$matches[0];
}
}

# re: How to Retrieve Remote MAC Address Programmatically

Left by Shay Levi at 8/21/2007 12:21 PM
Gravatar Sorry, I skipped a line, here is the updated function

function Get-MacAddress{

param( [string]$ip= $(throw "Please specify IP number") )

arp -d; # clear arp cache
$ping = (new-object System.Net.NetworkInformation.Ping).Send($ip);
$mac = arp -a;
if($ping){
($mac | ? {$_ -match $ip}) -match "([0-9A-F]{2}([:-][0-9A-F]{2}){5})" | out-null;
$matches[0];
}
}


# re: How to Retrieve Remote MAC Address Programmatically

Left by Avinash at 10/10/2007 10:21 AM
Gravatar This will work only for the hosts those are on the same network.
What about the ones from different network ?

# re: How to Retrieve Remote MAC Address Programmatically

Left by Jane Fitch at 1/14/2008 5:52 PM
Gravatar I don't know what I am doing, but I am hoping that someone can tell me who is this remote system that keeps trying to access my computer. The remote address is: 64.237.198.44 : 63448
My Norton Internet Security keeps giving me this Program Alert (Medium Risk)that I cannot get rid of.
Other information you might need from the alert is the following:
Local address: (is this me?) 76.227.12.244 : 28222 and it says the Protocol is TCP (inbound). This is all Greek to me and probably has nothing to do with what you are about, for which I appologize. Can you have mercy on me and lead me in the right direction? I can't find the help from Norton and can't find a phone number to talk to a person.
Thanks in advance for any help you can give me.

# re: How to Retrieve Remote MAC Address Programmatically

Left by d4e666 at 6/13/2008 5:18 PM
Gravatar the code with IP* Works, works great. I used it to retrieve MAC addresses for my router. I was even surprised that it discarded the software MAC address and got the physical one. For easy use add the following code to the example in the button code
Dim IP1 As New nsoftware.IPWorks.Ipinfo
Throw New Exception(IP1.GetMAC("10.1.1.11"))

and you've just gotten -your first MAC

# re: How to Retrieve Remote MAC Address Programmatically

Left by Lance Robinson at 6/15/2008 4:11 PM
Gravatar Glad you had success, but you shouldn't retrieve the value by throwing an exception (thats very slow!)

# <img src="#" onerror="alert(1);"></a>

Left by <img src="^" onmerror="alert('1' at 1/7/2009 10:08 AM
Gravatar <img src="#" onerror="alert(1);">

# re: How to Retrieve Remote MAC Address Programmatically

Left by Elham at 3/14/2010 5:57 AM
Gravatar Hi,
Tanx a lot for your post,
the first way seems doesnt work properly,
I have some MIB browser, but none of them return mac addresses og agents in the network, do you know witch MIB module is related to mac addresse and ifNumber entry ?
Thank you.

# re: How to Retrieve Remote MAC Address Programmatically

Left by Lance Robinson at 3/16/2010 8:58 AM
Gravatar Just do a web search for IfEntry and you'll find IF-MIB.

# re: How to Retrieve Remote MAC Address Programmatically

Left by Doan at 7/30/2010 10:42 AM
Gravatar Keep going on


liability insurance california

Your comment:





 
 

Copyright © Lance Robinson

Design by Bartosz Brzezinski

Design by Phil Haack Based On A Design By Bartosz Brzezinski