Showing posts with label scan. Show all posts
Showing posts with label scan. Show all posts

Thursday, 25 April 2019

ARP -SCAN for MAC Address Lookup

Summary
This post highlights how the arp (Win) or arp-scan (Linux) commands can be used in conjunction with online MAC address lookup tools, to assist in hardware identification of Ethernet devices.

Predicament
For a software development project a boxed cluster of Single Board Computers (SBC) was provided. The SBC cluster contained systems configured with static and dynamic IP addressing. No issue I mused, each SBC could be powered individually, the SBC that needed to be upgraded could then be identified. The real issue then presented itself, the cluster was boxed hardware and could not be opened and individual boards could not be powered or unpowered. One of the solutions that came to mind was the sometimes overlooked ARP command.

ARP Command (Windows)
Using ARP in the Windows command line may not be the most operator friendly solution, especially if a GUI based application is more your flavour. There are plenty of Windows applications such as the well-known Angry IP Scanner, Nmap or Free IP Scanner which will do a similar task. Some of these applications detail the OEM or hardware manufacturer in the scan results.

For testing with ARP, the SBC box was powered and networked directly to a development computer.

The arp -a command was issued from the Windows command line.


ARP Results
ARP Results
A doctored copy of the results from the arp are shown above. A few dynamic devices were listed. 

The first six characters of the MAC address were used to identify the vendors.


ARP Scan Command (Linux)
The arp-scan command used in Linux terminal produces similar results, usually including the hardware vendor.


ARP Scan Results
ARP Scan Results

MAC Lookup
For this SBC project the AskApache website was utilised for identification of the hardware vendor using the MAC addresses. A Google search will throw up numerous sites with similar search functionality, such as MAC Vendor Lookup.

On the AskApache site, the MAC address starting with b8 yielded the target SBC.


AskApache MAC Address Lookup
AskApache MAC Address Lookup
Results from the website show the target SBC was a Raspberry Pi.


AskApache MAC Address Lookup Result
AskApache MAC Address Lookup Result
Using the command line serves as handy reminder to the tools available in most operating systems.