Home page logo

nmap-dev logo Nmap Development mailing list archives

Re: MAC address
From: Fyodor <fyodor () insecure org>
Date: Thu, 26 Feb 2004 10:28:24 -0800

On Thu, Feb 26, 2004 at 06:11:16PM -0000, testic wrote:
As far as I am aware MAC addresses are only, or at least predominantly, used
in the ARP protocol, which is used in LAN situation. ARP packets will not be
routed over the internet. Therefore I would say that finding the MAC address
of a remote host over the internet would be very difficult.

That is true (when using ARP or the MAC address on received frames).
There are sometimes other ways to get remote MAC addresses (The
Windows ports often give them aways easily, so does SNMP, and some
IPv6 addresses include or are derived from the MAC address).

I would like to print the MAC address for a host based on the packets
received.  As Testic mentions this will only work on a LAN.  And of
course only on Ethernet and similar systems (like 802.11B).  It is
still valuable enough that I hope to add it this year.  If someone
wants it desperately enough, you can consider sending a patch earlier
:).  I might also do a number-of-hops test of some sort both as useful
information in itself and to determine whether the next hop is the
actual target and thus corresponds to the received MAC.


For help using this (nmap-dev) mailing list, send a blank email to 
nmap-dev-help () insecure org . List archive: http://seclists.org

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]