I am writing a custom application in Go. My app needs to work on Linux, macOS, and Windows 10+.
I need to verify that a remote host is what I think it is. I've tried arping and as expected, it does not cross routers. Is there any other way to get a remote host's MAC address if it is not on the local plan?
I know ARP does not cross routers. But I am hoping that the information is somehow given as an artifact of some other kind of communication.
Ideas?
The MAC address is a purely layer 2 (link layer) property. It is stripped when a packet is passed to layer 3 (network layer). This is the underlying reason why ARP does not work across routers. In order to get a MAC address from a network segment you are not directly connected to, you need the cooperation of a node which is directly connected to it. Possibilities:
a) The remote host itself whose MAC address you want to retrieve. You could simply ask it, but of course it may lie, so that's hardly useful if your goal is to unmask an impostor. It may also inadvertently expose it, for example by using it as the host part of its IPv6 address or otherwise including it in its layer 3 traffic, but you cannot rely on that, either.
b) The router forwarding packets from that network segment to you. It certainly sees the MAC address, and if you have administrative or SNMP access to it you may query it for that information.
c) Some other host on that network segment you can control, and from which you can issue an ARP request for the IP address of the host under investigation.
That said, checking the MAC address is not a reliable way to verify your peer's identity, anyway, since MAC addresses are easily forged. Depending on your needs, you may want to consider better, well-established and reliable means of host authentication such as TLS client and server certificates.
