Re: MAC address

[Fyodor <fyodor () insecure org>]

On Thu, Feb 26, 2004 at 06:11:16PM -0000, testic wrote:
> As far as I am aware MAC addresses are only, or at least predominantly, used
> in the ARP protocol, which is used in LAN situation. ARP packets will not be
> routed over the internet. Therefore I would say that finding the MAC address
> of a remote host over the internet would be very difficult.

That is true (when using ARP or the MAC address on received frames).
There are sometimes other ways to get remote MAC addresses (The
Windows ports often give them aways easily, so does SNMP, and some
IPv6 addresses include or are derived from the MAC address).

I would like to print the MAC address for a host based on the packets
received.  As Testic mentions this will only work on a LAN.  And of
course only on Ethernet and similar systems (like 802.11B).  It is
still valuable enough that I hope to add it this year.  If someone
wants it desperately enough, you can consider sending a patch earlier
:).  I might also do a number-of-hops test of some sort both as useful
information in itself and to determine whether the next hop is the
actual target and thus corresponds to the received MAC.

Cheers,
-F

---------------------------------------------------------------------
For help using this (nmap-dev) mailing list, send a blank email to 
nmap-dev-help () insecure org . List archive: http://seclists.org