0

I am trying to tell if a mac address is present on a network using c#

We are trying to make a whos in the office dashboard and we will check to see if the person's cell phone connected via wifi (who we will get the mac address from) is

I am not very strong in networking so I am not sure where to even start.

Crash893
  • 11,428
  • 21
  • 88
  • 123
  • That's what ARP is for. You host has an ARP cache of every MAC address it has used. You can't get a MAC address unless you try to connect to the host using IP, then ARP resolves the layer-3 address to the layer-2 address. The ARP cache will time out entries, but this time varies by OS. – Ron Maupin Aug 09 '16 at 21:07

2 Answers2

0

You can run a windows arp -a command line to find out all the devices that are connected to the current network.

You can then parse out the mac address of each line to figure out who is in the office.

Steve
  • 11,696
  • 7
  • 43
  • 81
  • have a look: http://stackoverflow.com/questions/850650/reliable-method-to-get-machines-mac-address-in-c-sharp – M.Hassan Aug 09 '16 at 19:04
  • @M.Hassan that's for getting your own MAC address isn't it? – Steve Aug 09 '16 at 19:06
  • 2
    Won't this only show entries that are in the ARP cache? That may not be a complete listing, unless I'm not fully understanding the arp command. – rmc00 Aug 09 '16 at 19:10
  • The link include GetMacUsingARP(string IPAddr) http://stackoverflow.com/a/1413201/3142139 – M.Hassan Aug 09 '16 at 19:12
  • @rmc00 yes. If the server stays on I would assume the arp cache has a complete listing. But if it just restarted then we are out of luck – Steve Aug 09 '16 at 19:14
  • @Steve Depending on how thorough the solution needs to be, I'm wondering if it makes sense to ping the broadcast domain to see what IP addresses are active on the local network. Then you can probably resolve most of the IPs that reply to MAC addresses with the ARP cache like you said and the others would need an ARP request to resolve. Just a thought... I like where you're headed with this, and I'm just trying to fill the only gap I see. – rmc00 Aug 09 '16 at 19:24
0

MAC addresses are stripped off at the first router/switch, so they're not going to be useful for determining what is connected, unless you can access the monitoring port on your router/switch and you only have one. If you're on a multi-hop network, it's useless.

edit

OK, I've removed a bunch of stuff I said, now that I understand you're talking about cell phones and wifi connections.

The very easiest way to do this that I can come up with is to set your router's DHCP lease time to something short like 10 minutes, then ask the router "who is connected".

The short least time will auto-renew whenever it expires as long as the client is still there.

Many routers display the current DHCP leases on a management page. You can scrape the page with your app and get a list of all currently active DHCP leases.

You can also get it from /tmp/dnsmasq.leases (on the router) if you're running a router that uses dnsmasq. (the location may change but /tmp is pretty common).

The first solution requires parsing a web page and the second requires getting a plain text file from the router and parsing it.

In any case, the best way to know "who is connected" is to ask the device they're connected to.

Terry Carmen
  • 3,720
  • 1
  • 16
  • 32
  • we are all on one switch for ethernet and wifi so i am not Concerned about the mac address being stripped off. My plan is to scan every 60-90 seconds and if someone is gone for 2-3 scans then mark them as "out of the office" – Crash893 Aug 09 '16 at 21:00
  • also i am referring to Cell phones that connect to my network via wifi sorry if i wasn't clear in the orginal post – Crash893 Aug 09 '16 at 21:03
  • That should work. If you can't ping the phone's WiFi interface for a few minutes, it's probably gone (or it just didn't connect). This assumes that cell phone wifi connections are pingable. I'm not certain if they are or not. – Terry Carmen Aug 09 '16 at 21:52