如何获取远程IP的mac地址

思路分析

• 由于java本身没有相关的jar包进行获取，所以这里介绍从其他的方面进行入手和实践

使用的工具对比:

• tcpdump
• tshark
• pcap4j

都可以达到抓包的效果，通过抓包和ping服务器达到服务器之间的通讯也就是tcp连接，进而拿到请求里面写到的网卡地址(mac)

三种方式对比

都是很老的项目，在GitHub上面发现最近更新三年前，实现起来也很复杂，动态库编译 jar编译，操作耗时又费力

新的思路分析

由上面三种方式的实际操作和共同的实现原理，改造而来的一种获取远程主机mac的地址的实现方式

• 获取远程IP的mac地址最主要的操作就是通过抓包获取请求里面携带的网卡信息，然后分析得到其中的Dst和Src信息格式如下

Ethernet II, Src: f8:ff:c2:48:3d:6d (f8:ff:c2:48:3d:6d), Dst: Hangzhou_54:80:02 (38:97:d6:54:80:02)

• 要想抓包得到结构就必须要有一步服务器之间要有通讯，就是在抓包开始的那个时间开始服务器之间要有至少一次的通讯才可以，也就是说 抓包->ping host->抓包结束->得到结果这样一个步骤

• 由于抓包的得到的结构都是.cap后缀 直接读取的话是一堆乱码经过分析之后可以得到mac地址分别为：

  fa 16 3e c8 fe 8f
  
  fa 16 3e b5 33 2f

  但是不好区分，其他的字符也不确定是什么意思，估计是转码的时候格式不一样吧

d4 c3 b2 a1 2 0 4 0 0 0 0 0 0 0 0 0 0 0 4 0 1 0 0 0 ad d4 bd 5f 15 9a 2 0 62 0 0 0 62 0 0 0

fa 16 3e c8 fe 8f

fa 16 3e b5 33 2f

8 0 45 0 0 54 de 1b 40 0 40 1 d4 e0 c0 a8 0 5 81 cc 45 33 8 0 c3 9e f bf 0 1 ad d4 bd 5f 0 0 0 0 f8 99 2 0 0 0 0 0 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35 36 37

转码的方法为：

 private static String byteReadStr(byte[] mac) {

        StringBuffer sb = new StringBuffer("");

        StringBuffer sbby = new StringBuffer("");

        for(int i=0; i<mac.length; i++) {

            sbby.append(mac[i]+" ");

            if(i!=0) {

                sb.append(" ");

            }

            //字节转换为整数

            int temp = mac[i]&0xff;

            String str = Integer.toHexString(temp);

            System.out.print(str+" ");

            if(str.length()==1) {

                sb.append("0"+str);

            }else {

                sb.append(str);

            }

        }

        return sb.toString().toUpperCase();

    }

• 后来我经过研究之后又发现了一种操作方式 就是借助第三方工具tshark进行分析.cap的抓包文件,可以得到如下信息

Frame 1: 98 bytes on wire (784 bits), 98 bytes captured (784 bits)

    Encapsulation type: Ethernet (1)

    Arrival Time: Nov 25, 2020 11:51:09.170517000 CST

    [Time shift for this packet: 0.000000000 seconds]

    Epoch Time: 1606276269.170517000 seconds

    [Time delta from previous captured frame: 0.000000000 seconds]

    [Time delta from previous displayed frame: 0.000000000 seconds]

    [Time since reference or first frame: 0.000000000 seconds]

    Frame Number: 1

    Frame Length: 98 bytes (784 bits)

    Capture Length: 98 bytes (784 bits)

    [Frame is marked: False]

    [Frame is ignored: False]

    [Protocols in frame: eth:ethertype:ip:icmp:data]

Ethernet II, Src: fa:16:3e:b5:33:2f (fa:16:3e:b5:33:2f), Dst: fa:16:3e:c8:fe:8f (fa:16:3e:c8:fe:8f)

    Destination: fa:16:3e:c8:fe:8f (fa:16:3e:c8:fe:8f)

        Address: fa:16:3e:c8:fe:8f (fa:16:3e:c8:fe:8f)

        .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)

        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)

    Source: fa:16:3e:b5:33:2f (fa:16:3e:b5:33:2f)

        Address: fa:16:3e:b5:33:2f (fa:16:3e:b5:33:2f)

        .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)

        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)

    Type: IPv4 (0x0800)

Internet Protocol Version 4, Src: 192.168.0.5, Dst: 12.21.69.51

    0100 .... = Version: 4

    .... 0101 = Header Length: 20 bytes (5)

    Differentiated Services Field: 0x00 (DSCP: CS0, ECN: Not-ECT)

        0000 00.. = Differentiated Services Codepoint: Default (0)

        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)

    Total Length: 84

    Identification: 0xde1b (56859)

    Flags: 0x4000, Don't fragment

        0... .... .... .... = Reserved bit: Not set

        .1.. .... .... .... = Don't fragment: Set

        ..0. .... .... .... = More fragments: Not set

    ...0 0000 0000 0000 = Fragment offset: 0

    Time to live: 64

    Protocol: ICMP (1)

    Header checksum: 0xd4e0 [validation disabled]

    [Header checksum status: Unverified]

    Source: 192.168.0.5

    Destination: 129.204.69.51

Internet Control Message Protocol

    Type: 8 (Echo (ping) request)

    Code: 0

    Checksum: 0xc39e [correct]

    [Checksum Status: Good]

    Identifier (BE): 4031 (0x0fbf)

    Identifier (LE): 48911 (0xbf0f)

    Sequence number (BE): 1 (0x0001)

    Sequence number (LE): 256 (0x0100)

    Timestamp from icmp data: Nov 25, 2020 11:51:09.000000000 CST

    [Timestamp from icmp data (relative): 0.170517000 seconds]

    Data (48 bytes)

0000  f8 99 02 00 00 00 00 00 10 11 12 13 14 15 16 17   ................

0010  18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 26 27   ........ !"#$%&'

0020  28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35 36 37   ()*+,-./01234567

        Data: f899020000000000101112131415161718191a1b1c1d1e1f…

        [Length: 48]

• 进行过滤之后可以得到 ～～～Ethernet II, Src: fa:16:3e:b5:33:2f (fa:16:3e:b5:33:2f), Dst: fa:16:3e:c8:fe:8f (fa:16:3e:c8:fe:8f)～～～

完整思路如下：

开始抓包 -> ping host -> 抓包结束输出结果到指定文件夹 ->利用tshark 分析文件得到结果

思路整理完成开始整合到代码里面进行资源mac地址监控操作，后续会放到github里面

*代码部分后续更新