2

With the purpose of registering many users on a big network (~600 users), each user's IP and MAC are needed. Currently, I am using arp command to retrieve the MAC, but for some users, I recieve an "incomplete" response. An example output:

LucasKobo.rede           ether   3c:77:e6:d2:31:eb   C                     eth0
android-b83812fa0aa8e77          (incomplete)                              eth0

Why is the arp response incomplete? And is there a fail proof way of getting each users MAC and IP on the application layer?

4
  • Assuming you have a DHCP server, it might be easier to get this info from the DHCP logs.
    – Ron Trunk
    Sep 15 '14 at 12:33
  • I have a DHCP server. But by looking at the logs, how would you suggest finding the IP and MAC of a given user(the IPs can change) ? And how would I access the logs remotely?
    – muzio
    Sep 15 '14 at 13:43
  • Every time the server creates a lease, it will log the MAC and IP. If you can access the server, you should be able to get the log files. Dump it into a spreadsheet or something and you can manipulate it as needed.
    – Ron Trunk
    Sep 15 '14 at 13:47
  • Thanks Ron. That is a very good solution, the only problem now, would be how to keep the logs in the DHCP synchronized with the other server.
    – muzio
    Sep 15 '14 at 13:51
4

Make sure the machine you're using to lookup the ARP table is in the same broadcast network as the MAC addresses you're looking for. If that's the case, generate some traffic towards the hosts you're looking for so that ARP requests will be sent. You can do this using ping for example, or sweep an entire network using nmap -sP <iprange>. After that, you should see an ARP entry in your ARP table if the device is online on the same broadcast network.

3
  • I know that it is not possible to send a packet without the MAC of the destination, but could there be any problem in showing the MACs using the arp command, even by doing what you suggested? Different OS, for example? Do all computer respond to a Arp request?
    – muzio
    Sep 15 '14 at 13:47
  • 1
    Yes all hosts need to reply to ARP requests.
    – Teun Vink
    Sep 15 '14 at 15:30
  • @muzio, ARP protocol is independent of the type of OS and hence all computers(hosts) shall respond to ARP request with ARP reply. Sep 22 '14 at 16:40
0

For ARP table, MAC address = (incomplete) = not alive. In other word, the machine is not on. You can try this by ping to any unused IP in the same network and then check the ARP table for that IP. The MAC address = (incomplete).

Note: This is on *nix. On Windows, no entry at all for IP without MAC address.

1
  • 1
    This is not correct. There may also have been no communication between the host doing the lookup and the host you're looking up, so the ARP entry isn't there at all or has been removed due to an ARP timeout. It may very well be on and connected though.
    – Teun Vink
    Sep 16 '14 at 5:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.