Reverse or inverse ARP from windows/linux - no way (!?!?)

tha=

Why not use NBNS? (I think RFC 1001 and 1002) Essentially you give your device a name such as NETMCA123456 where 123456 are the last 6 digits of the mac address, then listen for a broadcast to UDP port 137. If the query is for NETMCA123456 then it responds with its IP address.

This only really works on local subnets. It is supported natively under windows, so VNC from a windows machine should work fine.

The way it seems to work is that if windows thinks it is a local address (not sure how that is determined, maybe no '.'s ) then it broadcasts up to

On a simple network you don't need to worry about all the server stuff.

To play around, start up Wireshark monitoring UDP port 137 and try to connect to another machine on the same subnet using its name. Wireshark should then capture the NBNS sequence.

--------------------------------------- Posted through

IP

Thanks! This may well be it, I'll investigate.

Dimiter

------------------------------------------------------ Dimiter Popoff Transgalactic Instruments

------------------------------------------------------

I think I got to the bottom of it - why this is impossible under windows, that is. I had posted the same question in a local (Bulgarian) forum, and today a guy replied and posted this pointer:

Turns out this is just not doable under windows without defeating the system somehow... hence no such utility. He says he needed the same thing and wrote himself a GNU/Linux utility so apparently it is doable there; but I have not located such a utility in my half hours search (nor do I need it particularly, most if not all customers run windows and if someone is running linux chances are he will figure something out without my assistance. Here is the topic in the forum (Bulgarian/Cyrillic, most of you will see just funny characters :-) ):

Dimiter

------------------------------------------------------ Dimiter Popoff Transgalactic Instruments

------------------------------------------------------

Raw sockets is the ability to bypass the encapsulation of the lower level OS. All you need to do is send a legitimate UDP broadcast 'enquire' packet and receive uni-cast replies, I can't see why you would want to create your own raw packets and why you can't just use the OS to encapsulate your data normally (?)

Mark.

FYI:

Mark.

ur

So how do you send an ARP packet via UDP? (FYI: ARP is lower level than UDP).

Dimiter

I may have got this wrong, but I thought you wanted to find the address of a newly connected web-server on a local network and be able to configure a browser to access it. In which case all that is needed is to do is run a small utility on the browser PC that sends a UDP broadcast packet, the data portion of which contains the PC's IP address. The client, which has been allocated an address by the DHCP server, sees the UDP broadcast packet, and responds by uni-cast to the given address with *its* adddress in the data portion. The utility displays that address, which the user can either copy into the browser or click as a hyperlink. Why do you need ARP??

Mark.

today

level

packet

your

data

APR lower level than UDP? I don't think so. Same level at best, below = UDP=20 is MAC and PHY only.

And where does IP go in your world?

- PhiliP

ay

vel

cket

your

data

ow UDP

Uhm, not so sure. Same level as UDP in that they both have the Ethernet protocol type set to "internet", perhaps; but the data inside a UDP packet are encapsulated into that level, whereas the ARP data are purely Ethernet encapsulated. This should put it one level lower - at least unofficially?

Dimiter

vel

f a

No no, you are correct on that. I was just looking for some readily available utility, I avoid wintel programming like the plague, just the thought of their APIs etc. stuff makes me sick.

ta

That "angry IP scanner" I found is doing something similar (uses ICMP echo) and does the job for small networks. For large ones it will be less practical to manually dig through a huge list, though...

Dimiter

oday

level

packet

te your

r data

elow UDP

Or may be I forgot that, $806 was ARP and $800 was internet so may be they are officially different - Oh no, I may be dealing with their hex dumps and I may have implemented them but I really would not argue about the official side of things :-) . I know my stack handles the ARP packets at the same level as IP packets, UDP is one level "higher".

Dimiter

Ahha, you're after some already existing software to map MAC addresses to IP addresses.

If you open a command box in XP and type 'arp -a' you get a list of MAC addresses and their associated IP addresses. Is that what you want? you could easily write a batch file to scan for a given MAC address or dump to a file to search.

Mark.

In comp.protocols.tcp-ip markp wrote: (snip, someone wrote)

(snip)

Some will respond to a ping to the broadcast address, others not.

It seems that it you want to be found then you should respond.

Then you can ping to the broadcast address, followed by arp -a to see who replied.

-- glen

(snip)

MAC at layer 2 (ethernet switch level), IP at layer 3, TCP and UDP at layer 4.

Sometimes I think that ICMP should be layer 4 (as in ping), other times in layer 3. It does go inside an IP packet.

ARP does not have the IP (X'0800') ethernet type, so it seems that it should also be layer 3.

-- glen

Some will even respond differently to the subnet broadcast address (e.g.

=A0

Hmm, do you still think it is "simple" (just kidding :-)).

The necessity to poll, ping the entire subnet etc. nonsense summarizes what todays PC programming has become. Instead of simply sending a single packet to a known destination and use the single packet reply, why not send a few hundred or, better, a few thousand of them (the latter is the case when we would really need it to work, of course :-) ), then sift through the replies...

Dimiter

------------------------------------------------------ Dimiter Popoff Transgalactic Instruments

------------------------------------------------------

CDP comes to mind as one option with allows any connected device to advertise its identity and IP address on the local subnet. I'm aware that it has at least in theory been superceded by LLDP but I have no experience of that, and CDP is very simple whereas LLDP _may_ be more complex. It's primarily a Cisco protocol but it is documented and clients and viewers are available for Unix and Windows machines.

:-)

OK, the ARP way sounds like you've got to send a ping first to establish the route. However, since the only things you are worried about are your web-servers you can guarantee they respond to that as you would have programmed them too. As an aside, wouldn't the DHCP server when allocating addresses in the first place do that automatically?

The original idea of sending a UDP broadcast enquiry packet and getting replies is quite simple though. Only your servers would reply, and you could even send the desired server's MAC address in the enquiry packet so only one device that matches it would respond.

Mark.