1

How can I see the MAC address table of a Windows network bridge? Is it possible trough command line to find this information?

EDIT: I am interested to see the same table that it is possible to see in the managed switches (e.g. like the Cisco's show mac-address-table or Linux brctl showmacs br0)

2 Answers 2

3

The Network Bridge functionality appears to be wholly implemented (at least in Windows 7) by the bridge.sys driver. Without access to the bridge.sys source code it's difficult to say anything with certainty, but some cursory sniffing around the binary doesn't show any exposed APIs that would be helpful in dumping the layer 2 adjacency table.

(This ASCII text string embedded in the binary is a nice touch, though: Without specific written consent from Microsoft, it is illegal to reverse engineer, debug or change this binary.)

I think you're out-of-luck, from a documented and supported command-line perspective. Searching Microsoft's website for any command-line (or otherwise) tools that deal with the network bridge (aside from the paltry support in netsh) isn't turning up anything for me.

It's interesting to note that the names of the registry parameters specified for the Windows CE network bridge driver are present in the Windows 7 bridge.sys driver. This tends to make me think that these registry settings would work (not that any of them are helpful to you).

Dumping Windows kernel pool allocations is above my pay grade, but I suspect that if you were to figure out what the bridge.sys pool tag was (I suspect it's Brdg) and dump any pool allocations it makes you'd find the adjacency table in one of those allocations. Making that into a useful tool is left as an exercise to the reader. (>smile<)

2

on a windows system, you can run arp -a to display the arp table for each interface.. is that not what you are looking for?

8
  • 3
    arp only shows mac-addresses associated with IP-addresses. There can be a lot more going on than just IP traffic.
    – Tonny
    Aug 10, 2012 at 18:45
  • nmap sweep would show all mac addresses no? I believe there's a port to windows. Aug 10, 2012 at 18:51
  • Tis true.. would only show IP related MAC-addresses.
    – Rex
    Aug 10, 2012 at 18:54
  • 2
    First, the ARP table wouldn't even show MAC addresses associated with IP addresses unless the system had to associate them locally, which a bridge typically doesn't have to do. Second, Windows has to have a MAC address table independent of its L3 operation, otherwise it couldn't bridge Ethernet interfaces, and we know it can. Jul 6, 2014 at 9:23
  • 2
    @DavidSchwartz - The confusion people seem to have between ARP tables and layer 2 adjacency tables has amazed me for a long time. Books and other resources referring to layer 2 adjacency tables as "ARP tables" hasn't helped matters. I've pretty much just given up trying to explain it to people. Jul 6, 2014 at 10:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .