hazeii
Posts: 31
Joined: Sat Apr 25, 2015 8:33 am

Re: Grab MAC Addressses quickly?

Mon Aug 29, 2016 1:13 pm

The linux kernel has an option to ignore ping broadcasts, and it's turned off by default.

Code: Select all

 cat /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
 1
ARP-based approaches (nmap -sn, arping) have the advantage they will always work (even in cases where direct ping's - as well as broadcast - to the client are blocked). Having said that, if a client is there and an attempt is made to ping it, its MAC is still returned to the host (by ARP) even though the subsequent ICMP ECHO packet will be ignored.

User avatar
DougieLawson
Posts: 39581
Joined: Sun Jun 16, 2013 11:19 pm
Location: A small cave in deepest darkest Basingstoke, UK
Contact: Website Twitter

Re: Grab MAC Addressses quickly?

Mon Aug 29, 2016 1:43 pm

hazeii wrote:The linux kernel has an option to ignore ping broadcasts, and it's turned off by default.
So that fails the "Grab MAC addresses quickly" test that the OP wants. It's off because it's a vector for DDoS attacks.
Note: Any requirement to use a crystal ball or mind reading will result in me ignoring your question.

Criticising any questions is banned on this forum.

Any DMs sent on Twitter will be answered next month.
All fake doctors are on my foes list.

hazeii
Posts: 31
Joined: Sat Apr 25, 2015 8:33 am

Re: Grab MAC Addressses quickly?

Mon Aug 29, 2016 2:07 pm

Well, it fails completely[*]because a broadcast ping won't elicit an ARP response (unlike a direct ping, which will trigger an ARP response even if pings are completely disabled (with 'echo 1 > icmp_echo_ignore_all').

'nmap -sn' and 'arping' both do the same thing at the network level, so should both aways return the same results. 'nmap' is much faster (as noted) as it fires off requests in parallel, amongst other things.

[*] It did show up a couple of 486 boxes running 2.4.37.11 here :)

epoch1970
Posts: 5432
Joined: Thu May 05, 2016 9:33 am
Location: Paris, France

Re: Grab MAC Addressses quickly?

Mon Aug 29, 2016 2:27 pm

Mhh
I ran that from a Pi and physical and virtual nodes did respond.
There is no overly sophisticated switch on the path, though there are quite a few bridges.
So not a robust method. But still, it is quick.

Edit: I can't test seriously right now. My arp table was already populated and I forgot to nuke it.
I saw a Mac OS X machine respond to the broadcast.

Edit 2: Indeed I was wrong, can't detect Pis running Linux with a ping broadcast. I've annotated my initial post. Sorry.
"S'il n'y a pas de solution, c'est qu'il n'y a pas de problème." Les Shadoks, J. Rouxel

User avatar
pi3g
Authorised Reseller
Authorised Reseller
Posts: 147
Joined: Mon Nov 05, 2012 9:58 pm
Location: Germany
Contact: Website

Re: Grab MAC Addressses quickly?

Sat Jan 19, 2019 8:58 pm

Our free tool PiDoctor OS will allow you to test Pi's and get their MAC addresses (for WLAN & LAN).

https://picockpit.com/pidoctor

It works by booting into a specialized system based on Alpine Linux and running a test script. Many parameters are tested, including the MAC addresses.

You can test several Pi's in sequence, and without having to have a monitor or network cable attached. Literally the SD card and power is enough to test the Pi. It will indicate by blinking the ACT LED slowly (2sec on 2 sec off) that it is done with the test and you may safely unplug.

For each tested Pi a result .txt file in JSON format will be saved on the SD card. You can upload the file to PiCockpit / PiDoctor online to see a nice graphical representation, or you can parse the files yourself.

Here's how it looks like:

Image

And here's a blog post which goes more into detail about it. Feedback welcome!

https://pi3g.com/2019/01/05/introducing ... -about-it/
picockpit.com - tools to make your life with the Pi a little bit easier

Return to “General discussion”