Page 2 of 2

Re: Grab MAC Addressses quickly?

Posted: Mon Aug 29, 2016 1:13 pm
by hazeii
The linux kernel has an option to ignore ping broadcasts, and it's turned off by default.

Code: Select all

 cat /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
 1
ARP-based approaches (nmap -sn, arping) have the advantage they will always work (even in cases where direct ping's - as well as broadcast - to the client are blocked). Having said that, if a client is there and an attempt is made to ping it, its MAC is still returned to the host (by ARP) even though the subsequent ICMP ECHO packet will be ignored.

Re: Grab MAC Addressses quickly?

Posted: Mon Aug 29, 2016 1:43 pm
by DougieLawson
hazeii wrote:The linux kernel has an option to ignore ping broadcasts, and it's turned off by default.
So that fails the "Grab MAC addresses quickly" test that the OP wants. It's off because it's a vector for DDoS attacks.

Re: Grab MAC Addressses quickly?

Posted: Mon Aug 29, 2016 2:07 pm
by hazeii
Well, it fails completely[*]because a broadcast ping won't elicit an ARP response (unlike a direct ping, which will trigger an ARP response even if pings are completely disabled (with 'echo 1 > icmp_echo_ignore_all').

'nmap -sn' and 'arping' both do the same thing at the network level, so should both aways return the same results. 'nmap' is much faster (as noted) as it fires off requests in parallel, amongst other things.

[*] It did show up a couple of 486 boxes running 2.4.37.11 here :)

Re: Grab MAC Addressses quickly?

Posted: Mon Aug 29, 2016 2:27 pm
by epoch1970
Mhh
I ran that from a Pi and physical and virtual nodes did respond.
There is no overly sophisticated switch on the path, though there are quite a few bridges.
So not a robust method. But still, it is quick.

Edit: I can't test seriously right now. My arp table was already populated and I forgot to nuke it.
I saw a Mac OS X machine respond to the broadcast.

Edit 2: Indeed I was wrong, can't detect Pis running Linux with a ping broadcast. I've annotated my initial post. Sorry.

Re: Grab MAC Addressses quickly?

Posted: Sat Jan 19, 2019 8:58 pm
by pi3g
Our free tool PiDoctor OS will allow you to test Pi's and get their MAC addresses (for WLAN & LAN).

https://picockpit.com/pidoctor

It works by booting into a specialized system based on Alpine Linux and running a test script. Many parameters are tested, including the MAC addresses.

You can test several Pi's in sequence, and without having to have a monitor or network cable attached. Literally the SD card and power is enough to test the Pi. It will indicate by blinking the ACT LED slowly (2sec on 2 sec off) that it is done with the test and you may safely unplug.

For each tested Pi a result .txt file in JSON format will be saved on the SD card. You can upload the file to PiCockpit / PiDoctor online to see a nice graphical representation, or you can parse the files yourself.

Here's how it looks like:

Image

And here's a blog post which goes more into detail about it. Feedback welcome!

https://pi3g.com/2019/01/05/introducing ... -about-it/