How to get a different network's segment IP and MAC in Windows

Question

My network segment is 192.168.0.*, the target network segment is 192.168.1.*, and I can ping it.

I want to get the target's (e.g., 192.168.1.132's) MAC address in my program (C# or VC).

I know I can use nmap to scan the network in Linux, but how would I go about doing it in Windows? The subnet mask is 255.255.255.0.

Edit: Maybe nmap can not get mac address for different subnets too.

Answer 1

Telling us the network address without telling us the subnet mask is like telling us your house number is 12345 but not telling us the street name. I'll just assume that the subnet mask is 255.255.255.0.

You can't directly get the MAC address of the target machine if it resides in a different network for the following reasons:

A. The local machine will not ARP for the remote machine.

B. The local router will not ARP for the remote machine.

C. The remote router will ARP for the remote machine. The remote machine will respond to the ARP query and will send the rewspones to the querier, which is the remote router, where the response will stop.

If you need to find the MAC address of the remote machine you'll need access to the ARP cache on the remote router.

Answer 2

There is nmap for windows, you can download from namp site. Just look for the windows version, it even come with a GUI.

For C#, you can use SendARP().

Answer 3

For the same subnet:

arp will display your machine's arp table, which will include the MAC address of clients it's communicated with. So, ping, then arp to make sure you get a MAC address from the desired client.

(Use arp /? for the help/usage display on the command)

For a different subnet:

getmac /s [ip]

(Uses RPC, so better be Windows and need permissions on the target computer, so really only useful in an enterprise environment.)

EDIT : (Come to think of it, you might try the nbtstat command as well, given Windows. May or may not work, depending on the networking settings and configs, but it certainly can pull MAC addresses from different subnets.)

Answer 4

Assuming you know that the target is a Windows system, I would use WMI (the Windows CIM implementation) to accomplish this. Here is the same question answered for VB.Net, which is easy enough to translate to VC or C#. As the link says, be sure to import the System.Management and System.Management.Instrumentation namespaces.

Dim theManagementScope as new ManagementScope("\\" & ComputerName & "\root\cimv2")
Dim theQueryString as new string = "SELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = 1"

Dim theObjectQuery as new ObjectQuery(theQueryString)

Dim theSearcher as new ManagementObjectSearcher(theManagementScope, theObjectQuery)
Dim theResultsCollection as ManagementObjectCollection = theSearcher.Get()

for each currentResult as ManagementObject in theResultsCollection
   MessageBox.Show(currentResult("MacAddress").ToString())
next 

It may also be possible to get the information from the DHCP server with DhcpEnumSubnetClients, DhcpEnumSubnetClientsV4 or DhcpEnumSubnetClientsV5. Not sure what kind of permissions you need to run that or if it has to be run from the DHCP server, though. Docs aren't very clear.