I have mac table list of router, now I am trying to get a Ip address for each mac address in mac table list. So i tried to use ARP, unfortunately ARP is missing some of the mac addresses mapping which are listed under mac table. How to get all mac-IP address mappings. Is there any way to get these mappings? Will it be possible by updating ARP table, if so how to update it?
Use a tool like NMAP with the
-sP option (ping scan) against all subnets configured on interfaces:
nmap -sP [subnet IP]/[bitmask]
[repeat as needed for all connected subnets on router]
Then collect your SNMP information prior to the ARP timeout. If you still have MAC addresses in your CAM table that you can't correlate to an IP, they don't have one configured.
There isn't any good way to do this other than a crude nmap ping sweep of the entire subnet. You'll at least be able to resolve all of the addresses on the subnet to usable hardware addresses.
Below is the commonly used verbiage.
nmap -sn -n 10.0.0.0/24
-sn (No port scan) .
This option tells Nmap not to do a port scan after host discovery, and only print out the available hosts that responded to the scan. This is often known as a "ping scan", but you can also request that traceroute and NSE host scripts be run. This is by default one step more intrusive than the list scan, and can often be used for the same purposes. It allows light reconnaissance of a target network without attracting much attention. Knowing how many hosts are up is more valuable to attackers than the list provided by list scan of every single IP and host name.
Systems administrators often find this option valuable as well. It can easily be used to count available machines on a network or monitor server availability. This is often called a ping sweep, and is more reliable than pinging the broadcast address because many hosts do not reply to broadcast queries.
-n/-R: Never do DNS resolution/Always resolve [default: sometimes]