ARP requests

Discussion in 'Ruby' started by ninny, May 15, 2007.

  1. ninny

    ninny Guest

    Hello,

    I have a project to do in ruby witch consist in recover the ARP requests
    (who-has) on my local network and take the IP address if nobody answer
    to the ARP requests.
    I know identify an ARP request with "pcap" but I don't know how to take
    the IP address.

    If someone want help me, I would be very happy

    --
    Posted via http://www.ruby-forum.com/.
    ninny, May 15, 2007
    #1
    1. Advertising

  2. On 15.05.2007 12:21, ninny wrote:
    > I have a project to do in ruby witch consist in recover the ARP requests
    > (who-has) on my local network and take the IP address if nobody answer
    > to the ARP requests.
    > I know identify an ARP request with "pcap" but I don't know how to take
    > the IP address.


    I am not sure where your problems are but if you want to detect an IP
    address you can take this regexp for a start:

    /\d{1,3}(?:\.\d{1,3}){3}/

    Note that it does not match IPv6 addresses which might or might not be
    an issue. Note also, that it might match strings that are not IP addresses.

    Kind regards

    robert
    Robert Klemme, May 15, 2007
    #2
    1. Advertising

  3. On 5/15/07, Abhijit Gadgil <> wrote:

    > Not really sure about how you'd do this in ruby, but I have a
    > suggestion, if you are trying to monitor ARP requests on the network
    > and also ARP replies I am afraid, you'd not see most (infact all
    > except your own) of the ARP replies (standards compliant ARP replies
    > are not sent to broadcast MAC address) and you might end up thinking
    > nobody replied.


    Not sure how to do this from Ruby, but you can put the network adapter
    into promiscuous mode. This causes the adapter to pass all traffic
    into the OS, not just traffic addressed to the machine. This is how
    tools like ethereal do this.

    --
    Rick DeNatale

    My blog on Ruby
    http://talklikeaduck.denhaven2.com/
    Rick DeNatale, May 15, 2007
    #3
  4. Rick DeNatale, May 15, 2007
    #4
  5. On 5/15/07, Rick DeNatale <> wrote:
    > into promiscuous mode. This causes the adapter to pass all traffic
    > into the OS, not just traffic addressed to the machine. This is how
    > tools like ethereal do this.


    pcap will put the interface into promiscuous mode.

    The problem is that switches will not forward the traffic.

    Unfortunately, I don't know any real solution to the problem.

    Eivind.
    Eivind Eklund, May 15, 2007
    #5
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. =?Utf-8?B?QXVndXN0byBDw6lzYXI=?=

    Command Arp

    =?Utf-8?B?QXVndXN0byBDw6lzYXI=?=, Feb 22, 2005, in forum: ASP .Net
    Replies:
    1
    Views:
    745
    Tampa.NET Koder
    Feb 22, 2005
  2. Fernando Arámburu

    web requests and mobile requests

    Fernando Arámburu, Apr 8, 2005, in forum: ASP .Net
    Replies:
    1
    Views:
    433
    Joerg Jooss
    Apr 8, 2005
  3. seb

    getting quick arp request

    seb, Sep 6, 2006, in forum: Python
    Replies:
    11
    Views:
    594
    Daniel Nogradi
    Sep 7, 2006
  4. Muhammad Farooq-i-Azam

    What is the problem with my arp structure?

    Muhammad Farooq-i-Azam, Dec 17, 2004, in forum: C Programming
    Replies:
    3
    Views:
    385
    Chris Croughton
    Dec 17, 2004
  5. Send ARP

    , Jun 21, 2007, in forum: Java
    Replies:
    0
    Views:
    641
Loading...

Share This Page