LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Networking (http://www.linuxquestions.org/questions/linux-networking-3/)
-   -   Difference between ARP and iwgetid -ar MAC addresses? (http://www.linuxquestions.org/questions/linux-networking-3/difference-between-arp-and-iwgetid-ar-mac-addresses-801873/)

chconnor 04-13-2010 08:17 PM

Difference between ARP and iwgetid -ar MAC addresses?
 
Hello there -

I wrote up a script to do an automatic "phone home" from my laptop, in case it was stolen. It runs in the background, pinging a remote server every couple minutes with info. (The server-side script logs the IP as well).

One of the pieces of info sent on the URL is the MAC address of the wireless router connected to (if any).

I'm curious about the different MAC addresses I see for the wireless router... I'm obviously no networking expert. :-)

[Note: the center four hex pairs have been changed to 11:22:33:44 in these examples; the others are accurate.]

Code:

$ iwgetid -a eth1
eth1      Access Point/Cell: 02:11:22:33:44:55
[same MAC that shows up in iwlist eth1 scan...]

But:
Code:

$ arp
Address                  HWtype  HWaddress          Flags Mask            Iface
192.168.1.1              ether  00:11:22:33:44:52  C                    eth1

...is either of these MAC addresses more or less "accurate"?

In the config screen for the router itself (running dd_wrt), it shows:

Code:

LAN MAC
00:11:22:33:44:52
WAN MAC
00:11:22:33:44:54
Wireless MAC
00:11:22:33:44:54

...which agree more with arp.

I'm happy to chalk this up to "weird interface between dd_wrt and the router and arp and iwgetid", i'd just like to know that i'm not making any dumb mistakes (especially because the windows version i made is using the windows arp command to extract the same info...)

Thanks!
-C

chconnor 04-13-2010 08:35 PM

More info...
 
Ah, so. Logged into the router and did "ifconfig"; among the various interfaces listed I can see all the MAC addresses discovered via the above techniques... good to know that there's nothing too buggy about what i'm doing, but i'd still appreciate any advice as to which is "best".

Thanks,
-c

TimothyEBaldwin 04-14-2010 03:23 AM

They answer different questions. What are you trying to find the MAC address of?

chconnor 04-15-2010 01:22 PM

Thanks for the reply - I suppose what I'm most interested in is whichever would be useful if the laptop were ever stolen. In this case I suppose that would be whatever MAC address is easiest/most reliably confirmable as being associated with a particular router.

TimothyEBaldwin 04-16-2010 04:55 AM

The MAC address of the router (unless it's also access point) is not useful for finding the laptop as one won't be able relate that to any owner or a location. Nor do I think it will stand up in court.

I suggest the BSSID (MAC address) and SSID (network name) of all access points within range, the MAC address of the laptop, IP addresses assigned to the laptop, public IP addresses and port numbers, that's both IPv4 and IPv6.

chconnor 04-16-2010 03:22 PM

Quote:

Originally Posted by TimothyEBaldwin (Post 3937378)
The MAC address of the router (unless it's also access point) is not useful for finding the laptop as one won't be able relate that to any owner or a location. Nor do I think it will stand up in court.

I suggest the BSSID (MAC address) and SSID (network name) of all access points within range, the MAC address of the laptop, IP addresses assigned to the laptop, public IP addresses and port numbers, that's both IPv4 and IPv6.

Thanks, yeah, i was looking for the MAC of the router for the second reason: in case it was useful to confirm in some theoretical court where the person was, what they were connected to, etc; not for tracking down the location. So in terms of that, is there a preference between the "arp" MAC or the "iwgetid" MAC?

I am already gathering the all the MACs/SSIDs of the local access points, thanks. The laptop's MAC auto-changes on startup, so it's not useful. I thought about gathering the laptop's assigned IP, but decided it wouldn't be useful? Would it?

The server-side script notes the IP and any proxy IP of the hit to the page. Is there some other IP (v4 or 6) that qualifies as "public"? Perhaps you're talking about other IPs on the LAN?

Thanks a lot!
-c

TimothyEBaldwin 04-16-2010 06:47 PM

You seem to assume that the access point and the router are the same device, this isn't always the case; there may also be more than one router.

The "arp" command does not distinguish between hosts and routers, but this is unneeded. "ip neigh show" will show IPv6 information as well.

Therefore use "iwgetid -a" and "ip neigh show"

chconnor 04-17-2010 02:21 AM

Quote:

Originally Posted by TimothyEBaldwin (Post 3938074)
You seem to assume that the access point and the router are the same device, this isn't always the case

Ah, indeed i had forgotten that distinction, thanks.

Quote:

The "arp" command does not distinguish between hosts and routers, but this is unneeded. "ip neigh show" will show IPv6 information as well.

Therefore use "iwgetid -a" and "ip neigh show"
Thanks, will do. Appreciated,
-c


All times are GMT -5. The time now is 05:07 PM.