Results 1 to 16 of 16

Thread: How to get the ARP table.

  1. #1

    Thread Starter
    Frenzied Member
    Join Date
    Dec 2012
    Posts
    1,470

    How to get the ARP table.

    Sometimes you need to know what is active on your local network. This little application scans the ARP table and displays the results. So what is the ARP table? Your local network is more than likely an Ethernet network. Ethernet identifies each participant by a unique address called a MAC (Media Access Control) address. But we commonly communicate with other members of the local network using IP addresses. The ARP (Address Resolution Protocol) table is what is used to convert MAC addresses to IP addresses and visa versa.

    The entries of the ARP table are volatile. There are some permanent entries, but most of the entries are dynamic. The makeup is best explained by looking at the structure used to maintain the table.
    Code:
    Private Type MIB_IPNETROW
        dwIndex As Long 'Interface index of the adapter
        dwPhysAddrLen As Long 'The byte length of the MAC address
        bPhysAddr(8) As Byte  'The MAC address
        dwAddr As Long 'IPv4 IP Address (IPv6 is 16 bytes)
        dwType As Long 'The type of ARP entry 1 = Other, 2 = Invalid, 3 = Dynamic, 4 = static
    End Type
    Wait a minute. Why are there 8 bytes allocated for the MAC address when only 6 are required? That is because Windows works on Word boundaries (4 bytes), and the actual length used is defined in "dwPhysAddrLen".

    Each defined network has a broadcast address. For the MAC addresses it is "ff-ff-ff-ff-ff-ff" and is equated to the last address in the defined IP network. For example, a network defined as 192.168.1.0/24 (IP Mask 255.255.255.0) the last valid address would be 192.168.1.255. This results in a static ARP entry of:
    Code:
    192.168.1.255         ff-ff-ff-ff-ff-ff     static
    When a Ethernet device becomes active, it sends out an ARP announcement on the broadcast address advertising that it is joining the network. Other active participants should react to this message and add the address to it's dynamic table. By the same token, if an active participant wants to contact an inactive participant, it will send out an ARP broadcast message inviting that participant to join the network.

    So why does it go through this complicated process. Like any cache table, each entry in the table comes with a timeout. Older versions of Windows used to have a timeout of 2 minutes for ARP entries, while newer versions have lowered this time to a random value between 15 seconds and 45 seconds. If the address is not used again within that time, it is removed from the table. This prevents entries from becoming stale and overcrowding the table.

    J.A. Coutts
    Attached Images Attached Images  
    Attached Files Attached Files
    Last edited by couttsj; Aug 7th, 2019 at 11:03 AM.

  2. #2

    Thread Starter
    Frenzied Member
    Join Date
    Dec 2012
    Posts
    1,470

    Re: How to get the ARP table.

    In this version I have added dilettantes GetAdaptsInfo routine to identify the active Network Adapter and display only the associated IP addresses.

    Is it safe to assume that only the active Network Adapter will have a defined IP address?

    J.A. Coutts
    Attached Images Attached Images  
    Attached Files Attached Files

  3. #3
    Hyperactive Member
    Join Date
    Jan 2015
    Posts
    323

    Re: How to get the ARP table.

    VB Code:
    1. Attribute VB_Name = "modMAC"
    2. Option Explicit
    3.  
    4. 'original author dilettante
    5. '
    6. '=============
    7. 'GetAdaptsInfo
    8. '=============
    9. 'This module provides:
    10. '   o Public Type AdapterInfo
    11. '   o Public Function GetAdaptersInfo(ByRef AdaptersInfo() As AdapterInfo) As Long
    12. 'The purpose is to return a list of network adapters, their MAC address, their
    13. 'first (possibly only) IP address, their associated Default Gateway IP addresses,
    14. 'etc.
    15. '
    16.  
    17. Private Const MAX_ADAPTER_NAME_LENGTH = 260
    18. Private Const MAX_ADAPTER_ADDRESS_LENGTH = 8
    19. Private Const MAX_ADAPTER_DESCRIPTION_LENGTH = 132
    20. Private Const ERROR_SUCCESS = 0
    21. Private Const ERROR_NOT_SUPPORTED = 50
    22. Private Const ERROR_INVALID_PARAMETER = 87
    23. Private Const ERROR_BUFFER_OVERFLOW = 111
    24. Private Const ERROR_NO_DATA = 232
    25.  
    26. Public Type AdapterInfo
    27.     Name As String
    28.     AdapterIndex As Long
    29.     Type As Long
    30.     Address As String
    31.     IP As String
    32.     Description As String
    33.     GatewayIP As String
    34. End Type
    35.  
    36. Private Type IP_ADDR_STRING
    37.     Next As Long
    38.     IpAddress As String * 16
    39.     IpMask As String * 16
    40.     Context As Long
    41. End Type
    42.  
    43. Private Type IP_ADAPTER_INFO
    44.     Next As Long
    45.     ComboIndex As Long
    46.     AdapterName As String * MAX_ADAPTER_NAME_LENGTH
    47.     Description As String * MAX_ADAPTER_DESCRIPTION_LENGTH
    48.     AddressLength As Long
    49.     Address(MAX_ADAPTER_ADDRESS_LENGTH - 1) As Byte
    50.     index As Long
    51.     Type As Long
    52.     DhcpEnabled As Long
    53.     CurrentIpAddress As Long
    54.     IpAddressList As IP_ADDR_STRING
    55.     GatewayList As IP_ADDR_STRING
    56.     DhcpServer As IP_ADDR_STRING
    57.     HaveWins As Byte
    58.     PrimaryWinsServer As IP_ADDR_STRING
    59.     SecondaryWinsServer As IP_ADDR_STRING
    60.     LeaseObtained As Long
    61.     LeaseExpires As Long
    62. End Type
    63.  
    64. Public Enum AdatperType
    65.     MIB_IF_TYPE_OTHER = 1                             'Some other type of network interface.
    66.     MIB_IF_TYPE_ETHERNET = 6                          'An Ethernet network interface.
    67.     IF_TYPE_ISO88025_TOKENRING = 9                    'MIB_IF_TYPE_TOKENRING
    68.     MIB_IF_TYPE_PPP = 23                              'A PPP network interface.
    69.     MIB_IF_TYPE_LOOPBACK = 24                         'A software loopback network interface.
    70.     MIB_IF_TYPE_SLIP = 28                             'An ATM network interface.
    71.     IF_TYPE_IEEE80211 = 71                            'An IEEE 802.11 wireless network interface.
    72.     'This adapter type ireturned on Windows Vista and later, On Windows Server 2003 and Windows XP , returns MIB_IF_TYPE_ETHERNET.
    73. End Enum
    74.  
    75. Private Declare Function GetAdaptersInfoAPI Lib "IPHlpApi" Alias "GetAdaptersInfo" ( _
    76.                                             ByRef APIAdapterInfo As Any, ByRef pOutBufLen As Long) As Long
    77.  
    78. Private Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" ( _
    79.                                ByRef Destination As Any, ByRef Source As Any, ByVal Length As Long)
    80.  
    81. Private Function RNullTrim(ByVal Value As String) As String
    82.     Dim NulPos As Long
    83.     NulPos = InStr(Value, vbNullChar)
    84.     RNullTrim = Left$(Value, NulPos - 1)
    85. End Function
    86.  
    87. Private Function HexBytes(ByRef Bytes() As Byte, ByVal Length As Long) As String
    88.     Const HEX_CHARS As String = "0123456789ABCDEF"
    89.     Dim i As Long
    90.     If Length Then
    91.         HexBytes = String$(Length * 3 - 1, ":")
    92.         For i = 0 To Length - 1
    93.             Mid$(HexBytes, 1 + i * 3, 1) = mid$(HEX_CHARS, 1 + Bytes(i) \ &H10, 1)
    94.             Mid$(HexBytes, 2 + i * 3, 1) = mid$(HEX_CHARS, 1 + (Bytes(i) And &HF), 1)
    95.         Next
    96.     End If
    97. End Function
    98.  
    99. Public Function GetAdaptersInfo(ByRef AdaptersInfo() As AdapterInfo) As Long
    100. 'Returns count of adapters.
    101. 'Call GetAdaptersInfoAPI() and update the list of adapters and
    102. 'their Default Gateways.  If no adapters are found AdaptersInfo
    103. 'is not altered.
    104.     Dim pOutBufLen As Long
    105.     Dim APIAdapterInfoBuffer() As Byte
    106.     Dim pAdapt As Long
    107.     Dim APIAdapterInfo As IP_ADAPTER_INFO
    108.     Dim AdapterCount As Long
    109.     'Note:  GetAdaptersInfoAPI() returns a linked list of adapter entries.
    110.     'Find required buffer size.
    111.     pOutBufLen = 0
    112.     AdapterCount = 0
    113.     Select Case GetAdaptersInfoAPI(ByVal 0&, pOutBufLen)
    114.     Case ERROR_SUCCESS
    115.         Err.Raise &H8004B700, "GetAdaptersInfo", "GetAdaptersInfo Early Success: internal error"
    116.     Case ERROR_NOT_SUPPORTED
    117.         Err.Raise &H8004B710, "GetAdaptersInfo", "GetAdaptersInfo is not supported by this OS"
    118.     Case ERROR_INVALID_PARAMETER
    119.         Err.Raise &H8004B720, "GetAdaptersInfo", "GetAdaptersInfo Bad Parameters: internal error"
    120.     Case ERROR_BUFFER_OVERFLOW
    121.         ReDim APIAdapterInfoBuffer(pOutBufLen - 1)
    122.         'Get adapter information by calling with adequate buffer.
    123.         Select Case GetAdaptersInfoAPI(APIAdapterInfoBuffer(0), pOutBufLen)
    124.         Case ERROR_SUCCESS
    125.             pAdapt = VarPtr(APIAdapterInfoBuffer(0))
    126.             Do While pAdapt                           'Not 0.
    127.                 CopyMemory APIAdapterInfo, ByVal pAdapt, Len(APIAdapterInfo)
    128.                 ReDim Preserve AdaptersInfo(AdapterCount)
    129.                 With AdaptersInfo(AdapterCount)
    130.                     .Name = RNullTrim(APIAdapterInfo.AdapterName)
    131.                     .AdapterIndex = APIAdapterInfo.index
    132.                     .Description = RNullTrim(APIAdapterInfo.Description)
    133.                     .Type = APIAdapterInfo.Type
    134.                     .Address = HexBytes(APIAdapterInfo.Address, _
    135.                                         APIAdapterInfo.AddressLength)
    136.  
    137.                     'Take only 1st entry from each of next two lists, though
    138.                     'on a server OS their can be several.
    139.                     '
    140.                     'In theory these may be null.  If so we store an empty
    141.                     'String value.
    142.                     .IP = RNullTrim(APIAdapterInfo.IpAddressList.IpAddress)
    143.                     .GatewayIP = RNullTrim(APIAdapterInfo.GatewayList.IpAddress)
    144.                 End With
    145.                 pAdapt = APIAdapterInfo.Next
    146.                 AdapterCount = AdapterCount + 1
    147.             Loop
    148.             GetAdaptersInfo = AdapterCount
    149.         Case ERROR_NOT_SUPPORTED
    150.             Err.Raise &H8004B730, "GetAdaptersInfo", "GetAdaptersInfo Late Failure: is not supported by this OS"
    151.         Case ERROR_INVALID_PARAMETER
    152.             Err.Raise &H8004B740, "GetAdaptersInfo", "GetAdaptersInfo Late Failure, Bad Parameters: internal error"
    153.         Case ERROR_BUFFER_OVERFLOW
    154.             Err.Raise &H8004B750, "GetAdaptersInfo", "GetAdaptersInfo Late Failure: buffer overflow"
    155.         Case Else
    156.             Err.Raise &H8004B760, "GetAdaptersInfo", "GetAdaptersInfo Late Failure: system error " & CStr(Err.LastDllError)
    157.         End Select
    158.     Case ERROR_NO_DATA
    159.         Exit Function
    160.     Case Else
    161.         Err.Raise &H8004B770, "GetAdaptersInfo", _
    162.                   "GetAdaptersInfo system error " & CStr(Err.LastDllError)
    163.     End Select
    164. End Function
    Last edited by loquat; Aug 11th, 2019 at 09:53 AM.

  4. #4
    PowerPoster wqweto's Avatar
    Join Date
    May 2011
    Location
    Sofia, Bulgaria
    Posts
    5,120

    Re: How to get the ARP table.

    Wow, is this a coincidence or what :-))

    I was just "reviewing" dilletante's GetAdaptsInfo.bas and here I find it copy/pasted verbatim with no original author attribution. (No one else uses so complicated HexBytes implementation:-))

    Nice (NOT)!

    cheers,
    </wqw>

  5. #5
    Fanatic Member
    Join Date
    Aug 2016
    Posts
    673

    Re: How to get the ARP table.

    Quote Originally Posted by couttsj View Post
    In this version I have added dilettantes GetAdaptsInfo routine to identify the active Network Adapter and display only the associated IP addresses.

    Is it safe to assume that only the active Network Adapter will have a defined IP address?

    J.A. Coutts
    Debug.Print inet_addr("192.168.166.250") ' =-89741120 <0 ?

    If inet_addr(.IP) > 0 ? error

  6. #6
    Hyperactive Member
    Join Date
    Jan 2015
    Posts
    323

    Re: How to get the ARP table.

    it is not my code clearly
    i download the code here: http://www.vbforums.com/showthread.p...=1#post5261833
    and i have made a little change for myself, also change the module name, but the original code there have no author info, so lazy me, have not added the author info into the module
    sorry for @dilettante

    and i have found one more code of dilettante
    http://www.vbforums.com/showthread.p...=1#post3702645

  7. #7

    Thread Starter
    Frenzied Member
    Join Date
    Dec 2012
    Posts
    1,470

    Re: How to get the ARP table.

    This version replaces the ARP table lookup with ARP requests. This allows us to find network devices that are alive but not active. To accomplish this I am using the "SendARP" API call adapted from SendARP by Randy Birch.

    An ARP request does not necessarily consist of a single request. Before it gives up, it actually sends 3 requests for a total time on my system of 3.2 seconds (see packet jpeg). The API call does not return until after this period of time when requesting a non-utilized address. To prevent the program from hanging during this time, it needs to be on a separate thread. To accomplish this I am using a separate program and communicating between the 2 programs utilizing the Windows messaging system. When the "ARP" program is activated, it activates the "SendARP" program.

    The ARP program has 2 buttons. Like the previous program, the "Get Network" button finds the current adapter and lists some of it's properties. One of those properties is the network definition, which is calculated by "AND"ing the NetMask with the Adapter IP address. For example, if the Adapter address is "192.168.1.8" and the NetMask is "255.255.255.0", the result would be "192.168.1.0".

    When the "Get MAC" button is clicked, the network definition address is incremented by one and sent to the "SendARP" program. If "SendARP" gets a response to it's ARP request, it returns the MAC address immediately. If it does not get a response, it returns "Not Found!" after 3.2 seconds. If you click the "Get MAC" button several times in succession, it will increment the IP address that number of times and send out the requests. Obviously the requests are cached and returned in order. I do not know how many cached requests it can handle, but it can take some time if many IPs are not utilized. The safe way would be not to send another request until the response has been received from the previous request. This is a work in progress.

    A word of caution if you are stepping through the program and the system is unable to process system messages. It can cause some IDE functions to not respond, or in extreme cases to crash the IDE.

    J.A. Coutts
    Attached Images Attached Images   
    Attached Files Attached Files
    Last edited by couttsj; Aug 12th, 2019 at 09:32 AM.

  8. #8
    Addicted Member beic's Avatar
    Join Date
    Jun 2012
    Posts
    150

    Re: How to get the ARP table.

    Older post, but I like it!

    Any chance to populate the IP and the MAC Addresses into a ListView?

    Thanks!

  9. #9
    Addicted Member jg.sa's Avatar
    Join Date
    Nov 2017
    Location
    South Australia ( SA )
    Posts
    198

    Re: How to get the ARP table.

    G'Day JAC

    Sorry to go 'Off Topic"

    Quote Originally Posted by couttsj View Post
    see packet jpeg
    What is the PAcket Anal. software in this pic ?

    TIA

  10. #10

    Thread Starter
    Frenzied Member
    Join Date
    Dec 2012
    Posts
    1,470

    Re: How to get the ARP table.

    Quote Originally Posted by jg.sa View Post
    G'Day JAC

    Sorry to go 'Off Topic"



    What is the PAcket Anal. software in this pic ?

    TIA
    That is my network Packet Analyzer program.
    https://www.vbforums.com/showthread....cket-Ananlyzer

    J.A. Coutts

  11. #11
    Addicted Member jg.sa's Avatar
    Join Date
    Nov 2017
    Location
    South Australia ( SA )
    Posts
    198

    Re: How to get the ARP table.

    G'Day JAC

    After I posted this, I started to wonder if this was a 'Roll Your Own' app.

    Quote Originally Posted by couttsj View Post
    That is my network Packet Analyzer program.
    I'm so impressed with the breath of app. functionality you have created.

    Did you see my 'Contacts' app. Ad. on this site ?

    Then I could pay you for your efforts and a small 'repayment' for all your past efforts.

    BTW - I have a procedural C app. ( Yes not C Plus Plus - so decades old ) that interrogates a routers ARP cache as part of our security audit, if you do not use DHCP you can then trigger when hackers connect to a LAN

  12. #12

    Thread Starter
    Frenzied Member
    Join Date
    Dec 2012
    Posts
    1,470

    Re: How to get the ARP table.

    Quote Originally Posted by beic View Post
    Older post, but I like it!

    Any chance to populate the IP and the MAC Addresses into a ListView?

    Thanks!
    Probably. The Sub ProcMsg simply adds it to the Textbox at the moment.

    J.A. Coutts

  13. #13

    Thread Starter
    Frenzied Member
    Join Date
    Dec 2012
    Posts
    1,470

    Re: How to get the ARP table.

    Quote Originally Posted by jg.sa View Post
    G'Day JAC
    Did you see my 'Contacts' app. Ad. on this site ?
    Sorry, but I block scripts, so I have never seen your ad.
    J.A. Coutts

  14. #14
    Addicted Member beic's Avatar
    Join Date
    Jun 2012
    Posts
    150

    Re: How to get the ARP table.

    Quote Originally Posted by couttsj View Post
    Probably. The Sub ProcMsg simply adds it to the Textbox at the moment.
    I managed to do it, but after I came to conclusion that after the computer restart the ARP table would disappear / cleaned.

    Thank you for the code, because it was a really good lesson for me to learn more! +1

  15. #15
    Addicted Member jg.sa's Avatar
    Join Date
    Nov 2017
    Location
    South Australia ( SA )
    Posts
    198

    Re: How to get the ARP table.

    G'Day JAC

    This makes me laugh, I was trying to do too many things at the same time when I posted this


    Quote Originally Posted by couttsj View Post
    I have never seen your ad.
    The Ad. = forum post here not a google Ad. etc.

    https://www.vbforums.com/showthread....st-Task-system

    Plus I got confused with forums, this was a Task Sys. not Cont. Sys.

  16. #16
    PowerPoster
    Join Date
    Jan 2020
    Posts
    3,746

    Re: How to get the ARP table.

    How to use multiple network cards in a computer? Such as wired network card WIFI, USB network card, corresponding to 3 different optical fibers or broadband.
    How does a program specify a certain network card for downloading?
    Or 3 multi-threads, each thread uses a broadband network cable (network card)?

    route add IP1,NETCARD 1?
    Last edited by xiaoyao; Sep 2nd, 2021 at 08:05 PM.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  



Click Here to Expand Forum to Full Width