|
lxmxn
版主
积分 11386
发帖 4938
注册 2006-7-23
状态 离线
|
『第 31 楼』:
使用 LLM 解释/回答一下
根据 9527 和 qzwqzw 的思路，我是这样理解的：当ping完一个IP之后，如果这个IP所代表的主机是存活的，那么就会自动在路由表中记录这个IP和其MAC，但是我试了一下ping www.cn-dos.net，之后我用ARP -A，路由表中并没有出现www.cn-dos.net的IP以及MAC，请教这是什么原因？是不是这种方法只针对内网的主机呢？请各位不吝赐教。
According to the ideas of 9527 and qzwqzw, this is my understanding: After pinging an IP, if the host represented by this IP is alive, it will automatically record this IP and its MAC in the routing table. But I tried pinging www.cn-dos.net, and then I used ARP -A, and the routing table did not have the IP and MAC of www.cn-dos.net. Please tell me what the reason is? Is this method only for hosts in the internal network? Please give your advice.
|
|
 2006-12-31 00:55 |
|
|
9527
银牌会员
努力做坏人
积分 1185
发帖 438
注册 2006-8-28
来自 北京
状态 离线
|
『第 32 楼』:
使用 LLM 解释/回答一下
PING虽然也可以判断对方机器是否在线,不过成功率实在不敢恭维,效率也差的要命,还是用ARP好些,不过使用他的人一定要注意他的网段是192.168.1.0-192.168.1.255这个大家根据自己的情况改好了,不过运行速度不是太快,可能是PING给延误的,不过确实很实用的,大概解释一下,有人会问了,为什么你不直接把整段IP给FOR运行呢,我昨天试验了下,那样有些不准,所以分两段运行了,具体为什么不准这个我也不是很清楚,对于有防火墙的情况也是适用的,对屏蔽了ICMP包的机器也是适用的,因为他一定还给一个MAC地址给源计算机的,所以请大家放心使用就是了.
这是我原帖所写内容，你在从网上查一下，ARP好像只对内部网络操作有作用，对其外网是否存活好像基础命令是PING对方主机看TTL值，ARP就有一个好处那就是如果对方在线不管在线不在线对能够判断出来！！！
Although PING can also determine whether the other machine is online, the success rate is really not satisfactory, and the efficiency is extremely poor. It is better to use ARP. However, those who use it must pay attention that its network segment is 192.168.1.0-192.168.1.255. Everyone can modify it according to their own situation. But the running speed is not too fast, maybe because of the delay from PING. But it is indeed very practical. Let me explain roughly. Some people may ask, why don't you directly run FOR on the entire segment of IP? I tested it yesterday, and it was a bit inaccurate, so I ran it in two segments. I don't know exactly why it is inaccurate. It is also applicable in the case of a firewall, and also applicable to machines that have blocked ICMP packets, because it must still give a MAC address to the source computer, so please rest assured to use it.
This is what I wrote in the original post. I checked online. It seems that ARP only has an effect on internal network operations. For whether the external network is alive, the basic command is to PING the other host and look at the TTL value. ARP has one advantage that it can determine whether the other party is online regardless of whether it is online or not! ! !
|
我今后在论坛的目标就是做个超级坏人！！！ |
|
|
2006-12-31 01:13 |
|
|
lxmxn
版主
积分 11386
发帖 4938
注册 2006-7-23
状态 离线
|
『第 33 楼』:
使用 LLM 解释/回答一下
Originally posted by tghksj at 2006-12-30 10:25:
re lxmxn
-----------------------
net view得到"计算机名"列表
nbtstat -a "计算机名" 得到 MAC
------------------------
@ECHO %dbg% OFF
setlocal ENAB ...
将你的net view和nbtstat -a 得到的具体结果发来看看，我主要是看一下结果的格式，因为我这里没有内网环境。
Originally posted by tghksj at 2006-12-30 10:25:
re lxmxn
-----------------------
List of computers obtained by net view
MAC obtained by nbtstat -a "computer name"
------------------------
@ECHO %dbg% OFF
setlocal ENAB ...
Please send me the specific results obtained from your net view and nbtstat -a , I mainly need to look at the format of the results because I don't have an internal network environment here.
|
|
|
2006-12-31 02:01 |
|
|
tghksj
社区乞丐
此图片另存后死机
积分 -49
发帖 90
注册 2006-12-2
状态 离线
|
『第 34 楼』:
使用 LLM 解释/回答一下
net view :
--------------
服务器名称 注释
-------------------------------------------------------------------------------
\\GS
\\SERVER
\\T06
\\T11
\\T13
\\T14
\\T16
\\T18
\\T19
\\T20
\\T22
\\T23
\\T24
\\T25
\\T27
\\T28
\\T29
\\T34
\\T46
\\T49
\\T50
\\T51
\\T52
\\T53
\\T54
\\T60
命令成功完成。
--------------------------------------------
nbtstat -a T06:
---------------------------
本地连接:
Node IpAddress: Scope Id:
NetBIOS Remote Machine Name Table
Name Type Status
---------------------------------------------
T06 <00> UNIQUE Registered
K <00> GROUP Registered
T06 <20> UNIQUE Registered
K <1E> GROUP Registered
MAC Address = 00-E0-4C-10-44-49
nbtstat -a 命令竟然大小写结果不同........
NBTSTAT -A 不行......
[CODE]
net view :
--------------
Server Name Comment
-------------------------------------------------------------------------------
\\GS
\\SERVER
\\T06
\\T11
\\T13
\\T14
\\T16
\\T18
\\T19
\\T20
\\T22
\\T23
\\T24
\\T25
\\T27
\\T28
\\T29
\\T34
\\T46
\\T49
\\T50
\\T51
\\T52
\\T53
\\T54
\\T60
Command completed successfully.
--------------------------------------------
nbtstat -a T06:
---------------------------
Local Area Connection:
Node IpAddress: [222.173.24.71] Scope Id: []
NetBIOS Remote Machine Name Table
Name Type Status
---------------------------------------------
T06 <00> UNIQUE Registered
K <00> GROUP Registered
T06 <20> UNIQUE Registered
K <1E> GROUP Registered
MAC Address = 00-E0-4C-10-44-49
[/CODE]
The nbtstat -a command has different results for uppercase and lowercase........
NBTSTAT -A doesn't work......
|
|
|
2006-12-31 02:13 |
|
|
trickster
初级用户
积分 63
发帖 33
注册 2006-12-4
状态 离线
|
『第 35 楼』:
使用 LLM 解释/回答一下
Originally posted by ygzxw at 2006-12-28 04:12 PM:
这儿不让传图！！！发不了
可以发的,在你发贴时在最下面有提示:
图1
上传完成后根据提示找到文件连接地址即可.
Last edited by trickster on 2006-12-30 at 01:54 PM ]
Originally posted by ygzxw at 2006-12-28 04:12 PM:
Can't upload pictures here!!! Can't send
It can be sent. When you post, there is a prompt at the bottom:
Figure 1
After uploading is completed, find the file link address according to the prompt.
Last edited by trickster on 2006-12-30 at 01:54 PM ]
|
|
|
2006-12-31 02:46 |
|
|
everest79
金牌会员
一叶枝头，万树皆春
积分 2564
发帖 1127
注册 2006-12-25
状态 离线
|
『第 36 楼』:
使用 LLM 解释/回答一下
有个命令很方便，也不需要server服务来支持 arp -a ipaddress
There is a very convenient command, and it doesn't need server service support. arp -a ipaddress
|
|
|
2006-12-31 02:58 |
|
|
lxmxn
版主
积分 11386
发帖 4938
注册 2006-7-23
状态 离线
|
『第 37 楼』:
使用 LLM 解释/回答一下
@echo %dbg% off
setlocal enabledelayedexpansion
for /f "tokens=1 delims=\" %%i in ('net view^|find "\\"') do (
call :cname %%i
)
pause
goto :eof
:cname
for /f "tokens=2 delims==" %%j in ('nbtstat -a %1^|find "MAC Address"') do (
echo %1_%%j
)
goto :eof
再试试看？
Last edited by lxmxn on 2006-12-30 at 03:17 PM ]
@echo %dbg% off
setlocal enabledelayedexpansion
for /f "tokens=1 delims=\" %%i in ('net view^|find "\\"') do (
call :cname %%i
)
pause
goto :eof
:cname
for /f "tokens=2 delims==" %%j in ('nbtstat -a %1^|find "MAC Address"') do (
echo %1_%%j
)
goto :eof
Try again?
Last edited by lxmxn on 2006-12-30 at 03:17 PM ]
|
|
|
2006-12-31 03:04 |
|
|
tghksj
社区乞丐
此图片另存后死机
积分 -49
发帖 90
注册 2006-12-2
状态 离线
|
|
|
2006-12-31 04:04 |
|
|
lxmxn
版主
积分 11386
发帖 4938
注册 2006-7-23
状态 离线
|
『第 39 楼』:
使用 LLM 解释/回答一下
呵呵，谢谢楼上兄的提醒。由于没有环境，所以代码写好了就直接发上来了，没有测试。 =_=||
Hehe, thanks to the reminder from the elder brother upstairs. Since there's no environment, I just posted the code directly after writing it without testing. =_=||
|
|
|
2006-12-31 04:18 |
|
|
qzwqzw
银牌会员
天的白色影子
积分 2343
发帖 636
注册 2004-3-6
状态 离线
|
『第 40 楼』:
使用 LLM 解释/回答一下
arp -a 显示的并非路有表，而是ARP缓存表
前者是网络层的数据结构
后者是通过发送arp广播消息建立的，是个典型的数据链路层数据结构
数据链路层消息是不能跨网关的，所以只能在同一网段内（或者同一VLAN）
一个局域网内可能有多个网段或VLAN
---------------------------------------------
arp 并不比 ping 更好些，因为他们不是同一层次的程序
windows 的 arp 程序只操作本地arp缓存表，没有发出任何网络连接
所以如果不连接目标IP，是不可能arp 到mac的
所以，ping或者其他连接程序是 arp 的前提
除非有个arp程序可以自己发出arp请求消息
-------------------------------------------------------------------------
是否ping通与是否获取mac没有直接关系
因为ping采用icmp协议，位于网络层
网络层失败，并不意味着更低的数据链路层失败
但数据链路层失败，则网络层一定失败
所以，能ping通，就一定可以获得mac
能获得mac却不一定可以ping通
---------------------------------------------------------------------------------
印象中arp缓存表只保留10条最新的ip-mac记录
所以可能无法一次获取128条记录
但没有条件做测试，也很难说，这与系统有关，与协议无关
--------------------------------------------------------------------------------
The ARP - a shows not the routing table, but the ARP cache table.
The former is a data structure at the network layer.
The latter is established by sending ARP broadcast messages and is a typical data link layer data structure.
Data link layer messages cannot cross gateways, so they can only be within the same subnet (or the same VLAN).
There may be multiple subnets or VLANs in a local area network.
---------------------------------------------
ARP is not better than ping because they are not programs at the same layer.
The Windows ARP program only operates on the local ARP cache table and does not make any network connections.
So if you do not connect to the target IP, it is impossible to ARP to the MAC.
So ping or other connection programs are the precondition for ARP.
Unless there is an ARP program that can send ARP request messages by itself.
-------------------------------------------------------------------------
Whether ping is successful has no direct relationship with whether the MAC is obtained.
Because ping uses the ICMP protocol, which is at the network layer.
A failure at the network layer does not mean a failure at the lower data link layer.
But a failure at the data link layer means that the network layer must be failed.
So if you can ping successfully, you must be able to obtain the MAC.
It is possible to obtain the MAC but not be able to ping successfully.
---------------------------------------------------------------------------------
I remember that the ARP cache table only keeps 10 latest IP - MAC records.
So it may not be possible to obtain 128 records at one time.
But there are no conditions for testing, and it is difficult to say. This is related to the system, not the protocol.
|
|
|
2006-12-31 06:06 |
|
|
vkill
金牌会员
积分 4103
发帖 1744
注册 2006-1-20
来自 甘肃.临泽
状态 离线
|
『第 41 楼』:
使用 LLM 解释/回答一下
应该先看看 $ipc
You should first take a look at $ipc
|
|
|
2006-12-31 06:13 |
|
|
lxmxn
版主
积分 11386
发帖 4938
注册 2006-7-23
状态 离线
|
『第 42 楼』:
使用 LLM 解释/回答一下
多谢40楼兄的指点，明白一些了。
Thanks to the guidance from Brother 40, I understand something now.
|
|
|
2006-12-31 06:42 |
|
|
everest79
金牌会员
一叶枝头，万树皆春
积分 2564
发帖 1127
注册 2006-12-25
状态 离线
|
『第 43 楼』:
使用 LLM 解释/回答一下
Originally posted by qzwqzw at 2006-12-30 05:06 PM:
arp -a 显示的并非路有表，而是ARP缓存表
前者是网络层的数据结构
后者是通过发送arp广播消息建立的，是个典型的数据链路层数据结构
数据链蠮..
刚才没注意看，以为是要获得ping以后的MAC地址
arp本地缓存应支持超过256个条目
Originally posted by qzwqzw at 2006-12-30 05:06 PM:
arp -a displays not the routing table but the ARP cache table
The former is a data structure at the network layer
The latter is established by sending ARP broadcast messages and is a typical data structure at the data link layer
Data link...
Just now I didn't pay attention, I thought it was to obtain the MAC address after ping
The local ARP cache should support more than 256 entries
|
|
|
2006-12-31 06:51 |
|
|
everest79
金牌会员
一叶枝头，万树皆春
积分 2564
发帖 1127
注册 2006-12-25
状态 离线
|
『第 44 楼』:
使用 LLM 解释/回答一下
@echo off
FOR /F "tokens=4-7 delims=. " %%i IN ('ipconfig^|find /i "ip address"') do set i1=%%i&set i2=%%j&set i3=%%k&set i4=%%l
FOR /F "tokens=4-7 delims=. " %%i IN ('ipconfig^|find /i "subnet"') do set m1=%%i&set m2=%%j&set m3=%%k&set m4=%%l
if "%m2%" == "0" (set b=1&set bb=254) else set b=%i2%&set bb=%i2%
if "%m3%" == "0" (set c=1&set cc=254) else set c=%i3%&set cc=%i3%
echo.>mac.dat
for /l %%b in (%b%,1,%bb%) do (
for /l %%c in (%c%,1,%cc%) do (
for /l %%d in (1,1,20) do (
ping -l 1 -w 1 -n 1 -i 1 %i1%.%%b.%%c.%%d>nul
arp -a %i1%.%%b.%%c.%%d|find "%i1%.%%b.%%c.%%d"|findstr "static dynamic">>mac.dat
set /p=%%d <nul)
)
)
echo.
type mac.dat
pause
我这也有一个，原来配置交换机时写的
```
@echo off
FOR /F "tokens=4-7 delims=. " %%i IN ('ipconfig^|find /i "ip address"') do set i1=%%i&set i2=%%j&set i3=%%k&set i4=%%l
FOR /F "tokens=4-7 delims=. " %%i IN ('ipconfig^|find /i "subnet"') do set m1=%%i&set m2=%%j&set m3=%%k&set m4=%%l
if "%m2%" == "0" (set b=1&set bb=254) else set b=%i2%&set bb=%i2%
if "%m3%" == "0" (set c=1&set cc=254) else set c=%i3%&set cc=%i3%
echo.>mac.dat
for /l %%b in (%b%,1,%bb%) do (
for /l %%c in (%c%,1,%cc%) do (
for /l %%d in (1,1,20) do (
ping -l 1 -w 1 -n 1 -i 1 %i1%.%%b.%%c.%%d>nul
arp -a %i1%.%%b.%%c.%%d|find "%i1%.%%b.%%c.%%d"|findstr "static dynamic">>mac.dat
set /p=%%d <nul)
)
)
echo.
type mac.dat
pause
```
|
|
|
2006-12-31 06:54 |
|
|
qzwqzw
银牌会员
天的白色影子
积分 2343
发帖 636
注册 2004-3-6
状态 离线
|
『第 45 楼』:
使用 LLM 解释/回答一下
写的不错
再完善一下就可以做标配工具了
首先是对非0的掩码的支持
其次是对（1，1，20）的问题，不知道你是如何考虑的，是抽样吗？
另外，arp的条目总数不知是否系统版本影响
如果确定不低于256，那么为什么不在ping完一个段后，再arp -a呢
Well written. It can be made into a standard tool after further improvement. First, support for non - 0 masks. Second, regarding the problem of (1, 1, 20), I don't know how you thought about it. Is it sampling? In addition, does the total number of ARP entries depend on the system version? If it is determined that it is not less than 256, then why not perform arp - a after pinging a segment?
|
|
|
2006-12-31 09:11 |
|
