Thursday 25 April 2019

ARP -SCAN for MAC Address Lookup

Summary
This post highlights how the arp (Win) or arp-scan (Linux) commands can be used in conjunction with online MAC address lookup tools, to assist in hardware identification of Ethernet devices.

Predicament
For a software development project a boxed cluster of Single Board Computers (SBC) was provided. The SBC cluster contained systems configured with static and dynamic IP addressing. No issue I mused, each SBC could be powered individually, the SBC that needed to be upgraded could then be identified. The real issue then presented itself, the cluster was boxed hardware and could not be opened and individual boards could not be powered or unpowered. One of the solutions that came to mind was the sometimes overlooked ARP command.

ARP Command (Windows)
Using ARP in the Windows command line may not be the most operator friendly solution, especially if a GUI based application is more your flavour. There are plenty of Windows applications such as the well-known Angry IP Scanner, Nmap or Free IP Scanner which will do a similar task. Some of these applications detail the OEM or hardware manufacturer in the scan results.

For testing with ARP, the SBC box was powered and networked directly to a development computer.

The arp -a command was issued from the Windows command line.


ARP Results
ARP Results
A doctored copy of the results from the arp are shown above. A few dynamic devices were listed. 

The first six characters of the MAC address were used to identify the vendors.


ARP Scan Command (Linux)
The arp-scan command used in Linux terminal produces similar results, usually including the hardware vendor.


ARP Scan Results
ARP Scan Results

MAC Lookup
For this SBC project the AskApache website was utilised for identification of the hardware vendor using the MAC addresses. A Google search will throw up numerous sites with similar search functionality, such as MAC Vendor Lookup.

On the AskApache site, the MAC address starting with b8 yielded the target SBC.


AskApache MAC Address Lookup
AskApache MAC Address Lookup
Results from the website show the target SBC was a Raspberry Pi.


AskApache MAC Address Lookup Result
AskApache MAC Address Lookup Result
Using the command line serves as handy reminder to the tools available in most operating systems.


3 comments:

  1. whoah this weblog is excellent i like reading your posts.
    Keep up the great work! You already know, lots of
    persons are hunting around for this information, you could help them greatly.

    ReplyDelete
  2. Hi i have a problem with Psoc5 LP prototyping board c8y-059. I try to use one wire up to 8 devices on the bus. I was trying to update it from your last project but it doesnt work...could you help me with that ? Please respond to maciek220988@gmail.com Thanks a lot !!!

    ReplyDelete
  3. @Maciek, thanks for the PSoC question, try the PSoC Forum they have a few example that may help - https://community.cypress.com/thread/28125

    ReplyDelete