Difference between ARP and iwgetid -ar MAC addresses?
 

Hello there -

I wrote up a script to do an automatic "phone home" from my laptop, in case it was stolen. It runs in the background, pinging a remote server every couple minutes with info. (The server-side script logs the IP as well).

One of the pieces of info sent on the URL is the MAC address of the wireless router connected to (if any).

I'm curious about the different MAC addresses I see for the wireless router... I'm obviously no networking expert. :-)

[Note: the center four hex pairs have been changed to 11:22:33:44 in these examples; the others are accurate.]

But:
...is either of these MAC addresses more or less "accurate"?

In the config screen for the router itself (running dd_wrt), it shows:

...which agree more with arp.

I'm happy to chalk this up to "weird interface between dd_wrt and the router and arp and iwgetid", i'd just like to know that i'm not making any dumb mistakes (especially because the windows version i made is using the windows arp command to extract the same info...)

Thanks!
-C

More info...
 

Ah, so. Logged into the router and did "ifconfig"; among the various interfaces listed I can see all the MAC addresses discovered via the above techniques... good to know that there's nothing too buggy about what i'm doing, but i'd still appreciate any advice as to which is "best".

Thanks,
-c

They answer different questions. What are you trying to find the MAC address of?

Thanks for the reply - I suppose what I'm most interested in is whichever would be useful if the laptop were ever stolen. In this case I suppose that would be whatever MAC address is easiest/most reliably confirmable as being associated with a particular router.

The MAC address of the router (unless it's also access point) is not useful for finding the laptop as one won't be able relate that to any owner or a location. Nor do I think it will stand up in court.

I suggest the BSSID (MAC address) and SSID (network name) of all access points within range, the MAC address of the laptop, IP addresses assigned to the laptop, public IP addresses and port numbers, that's both IPv4 and IPv6.

Thanks, yeah, i was looking for the MAC of the router for the second reason: in case it was useful to confirm in some theoretical court where the person was, what they were connected to, etc; not for tracking down the location. So in terms of that, is there a preference between the "arp" MAC or the "iwgetid" MAC?

I am already gathering the all the MACs/SSIDs of the local access points, thanks. The laptop's MAC auto-changes on startup, so it's not useful. I thought about gathering the laptop's assigned IP, but decided it wouldn't be useful? Would it?

The server-side script notes the IP and any proxy IP of the hit to the page. Is there some other IP (v4 or 6) that qualifies as "public"? Perhaps you're talking about other IPs on the LAN?

Thanks a lot!
-c

You seem to assume that the access point and the router are the same device, this isn't always the case; there may also be more than one router.

The "arp" command does not distinguish between hosts and routers, but this is unneeded. "ip neigh show" will show IPv6 information as well.

Therefore use "iwgetid -a" and "ip neigh show"

Ah, indeed i had forgotten that distinction, thanks.

Thanks, will do. Appreciated,
-c