Unix administration - Retrieving MAC address for given IP from BIND server?

Author

Retrieving MAC address for given IP from BIND server?

andrejohn.mas@gmail.com

2006-11-16, 1:17 pm

Hi,

I looking at writing a small wake-on-lan program that would allow
corporate employees to put their computers in stand-by and then wake
them up when they need to work on the VPN. The only catch is employees
wil generally only know the name of the computer and not its MAC
address. For this reason the program needs a mapping of DHCP <-> IP
addresses.

Is there any way to be able to communicate with it to get the MAC
address of a machine, given its IP address. Failing that is there any
way to get it to publish its list in a text file and also have that
done automatically? I believe the server is using BIND.

Andre

Mark Rafn

2006-11-16, 7:20 pm

<andrejohn.mas@gmail.com> wrote:
>I looking at writing a small wake-on-lan program that would allow
>corporate employees to put their computers in stand-by and then wake
>them up when they need to work on the VPN. The only catch is employees
>wil generally only know the name of the computer and not its MAC
>address. For this reason the program needs a mapping of DHCP <-> IP
>addresses.

You mean mapping of name -> MAC, don't you? It's possible the user's machine
has released or expired its DHCP lease, and has no IP address.

>Is there any way to be able to communicate with it to get the MAC
>address of a machine, given its IP address.

What's "it" in this sentence? When the user's machine is running, you can
use DNS (assuming it's set up reasonably to deal with dynamic addresses) to
find the name->IP address, then use a machine on the same subnet to ARP that
address and get the MAC address.

Once the user's machine is in standby and has lost it's DHCP lease, there _IS_
no IP address assigned to it, and it wouldn't respond to ARP anyway. So you
have to save the information while the machine's running to use later.

>way to get it to publish its list in a text file and also have that
>done automatically? I believe the server is using BIND.

BIND is name->IP mapping only. It won't know anything about mac addresses.

DHCP is likely the place to do this, and it will depend on how you assign
names and addresses. It's possible that your DHCP config has all the data you
need (as it assigns IP based on MAC), and you don't need your own mapping at
all.

If not, it's possible that you can look at both DNS and dhcpd.leases (or
wherever your dhcp server tracks current assignments) periodically to keep
your copy of the name->MAC map updated.
--
Mark Rafn dagon@dagon.net <http://www.dagon.net/>

andrejohn.mas@gmail.com

2006-11-16, 7:20 pm

Part of my confusion with BIND, is that I thought it included DHCP
server support. Certainly I would need to speak to the DHCP server to
ask for that information though how I would do that I am sure, which is
really where I need the help. If you can help me there I would
certainly appreciate the help.

The reason I also wanted the IP addresses is that it would mean I would
not need to broadcast the packets, since from my tests there is no
gurantee the broadcast will always reach the right computer. It is
possible that I am doing something wrong with the way I am doing the
broadcast. Of course the use of an IP address for a computer assumes a)
the lease is for more than a few days and b) the computer has not
released its lease

Andre

On Nov 16, 2:11 pm, d...@dagon.net (Mark Rafn) wrote:
> <andrejohn....@gmail.com> wrote:
> has released or expired its DHCP lease, and has no IP address.
>
> use DNS (assuming it's set up reasonably to deal with dynamic addresses) to
> find the name->IP address, then use a machine on the same subnet to ARP that
> address and get the MAC address.
>
> Once the user's machine is in standby and has lost it's DHCP lease, there _IS_
> no IP address assigned to it, and it wouldn't respond to ARP anyway. So you
> have to save the information while the machine's running to use later.
>
>
> DHCP is likely the place to do this, and it will depend on how you assign
> names and addresses. It's possible that your DHCP config has all the data you
> need (as it assigns IP based on MAC), and you don't need your own mapping at
> all.
>
> If not, it's possible that you can look at both DNS and dhcpd.leases (or
> wherever your dhcp server tracks current assignments) periodically to keep
> your copy of the name->MAC map updated.
> --
> Mark Rafn d...@dagon.net <http://www.dagon.net/>

Mark Rafn

2006-11-17, 1:25 am

<andrejohn.mas@gmail.com> wrote:
>Part of my confusion with BIND, is that I thought it included DHCP
>server support.

At this point, I'd recommend hiring someone to help you. You're confused on
issues that are basic, but complicated enough that solving on Usenet is
unlikely.

>The reason I also wanted the IP addresses is that it would mean I would
>not need to broadcast the packets, since from my tests there is no
>gurantee the broadcast will always reach the right computer.

There's no guarantee a machine even has an ip address when it's in standby.
You need to send the WoL message from a machine on the correct subnet. It's
not a broadcast per se, but it follows most of the same rules, so if you can't
broadcast to it, you probably can't send a Wake on LAN packet either.

>It is possible that I am doing something wrong with the way I am doing the
>broadcast. Of course the use of an IP address for a computer assumes a)
>the lease is for more than a few days and b) the computer has not
>released its lease

Exactly. And that the WoL packet is routable to the correct place.
http://www.camden411.com/tcpipfaq/wol.html showed up on a quick google search,
and may help out.

Good luck!
--
Mark Rafn dagon@dagon.net <http://www.dagon.net/>

Moe Trin

2006-11-17, 7:23 pm

On 16 Nov 2006, in the Usenet newsgroup comp.unix.admin, in article
<1163706325.946488.85110@k70g2000cwa.googlegroups.com>, andrejohn.mas@gmail.com
wrote:

>Part of my confusion with BIND, is that I thought it included DHCP
>server support.

That's possible, but it's not a "standard feature". You've just
discovered another major problem about using DHCP, never mind all of
the security issues.

>Certainly I would need to speak to the DHCP server to ask for that
>information though how I would do that I am sure, which is really where
>I need the help. If you can help me there I would certainly appreciate
>the help.

Actually, that may be of little use anyway. For any packet to be
transmitted in _unicast_ mode, the local sending station (probably
a router in this case) has to know the MAC <-> IP mapping. This data
would be in the ARP cache on the router. Problem is, ARP data is supposed
to expire off the cache after a period of inactivity. RFC1122 Section
2.3.2.1 speaks of a timeout on the order of one minute, but most routers
use a substantially longer interval - perhaps up to an hour or two. If
the hosts ARP entry has expired off the cache, then the router must ARP
to obtain the "current" MAC/IP relationship. Your sleeping host will not
respond to that, and the router can not send a unicast. If you are using
a switched network, your Ethernet switches may also have an MAC cache for
traffic isolation. You can set up a static MAC/IP file, which means
that the individual host must obtain the same address each time it
contacts the DHCP server, but in that case why not set configure the hosts
to a static configuration and get rid of the DHCP service entirely.

>The reason I also wanted the IP addresses is that it would mean I would
>not need to broadcast the packets, since from my tests there is no
>gurantee the broadcast will always reach the right computer. It is
>possible that I am doing something wrong with the way I am doing the
>broadcast.

That's a function of the networking setup. Today, most people drop
packets to broadcast addresses at routers as a defense against Denial
Of Service attacks. This may also be the case on your Ethernet switches.

>Of course the use of an IP address for a computer assumes a) the lease
>is for more than a few days and b) the computer has not released its
>lease

Ah, but you forgot about the ARP cache in the routers.

The way we implemented this was a simple server daemon on each subnet that
the luser can connect to and send a "wake up $MYBOX" command. While our
routers all drop packets sent to local broadcast addresses, our switches
don't, so the server merely executes a 'ping -c 3 -s 240 -p $MAC_ADDRESS
$LOCAL_BROADCAST' (for example 'ping -c 3 -s 240 -p 080020ea5fcc
192.0.2.255') which sends an ICMP packet to the subnet broadcast address
(which all of our systems ignore by default) that contains the magic
(at least) 16 repetitions of the target MAC address. We send it three
times in case it gets dropped by the switch due to other traffic. Note
that this should also be able to work on a DHCP setup if the local server
has a current 'hostname <-> MAC' table.

Old guy