Share this question

Welcome to Teachnovice Q&A, where you can ask questions and receive answers from other members of the community.

This is a collaboratively edited question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How to get a different network's segment IP and MAC in Windows

0 like 0 dislike

My network segment is 192.168.0.*, the target network segment is 192.168.1.*, and I can ping it.

I want to get the target's (e.g.,'s) MAC address in my program (C# or VC).

I know I can use nmap to scan the network in Linux, but how would I go about doing it in Windows? The subnet mask is

Edit: Maybe nmap can not get mac address for different subnets too.

asked Nov 12, 2014 by peter  

4 Answers

0 like 0 dislike
Best answer
Telling us the network address without telling us the subnet mask is like telling us your house number is 12345 but not telling us the street name. I'll just assume that the subnet mask is

You can't directly get the MAC address of the target machine if it resides in a different network for the following reasons:

A. The local machine will not ARP for the remote machine.

B. The local router will not ARP for the remote machine.

C. The remote router will ARP for the remote machine. The remote machine will respond to the ARP query and will send the rewspones to the querier, which is the remote router, where the response will stop.

If you need to find the MAC address of the remote machine you'll need access to the ARP cache on the remote router.
answered Nov 12, 2014 by joeqwerty  
I don't see how it's possible for nmap to do that, but I've never used nmap. The local machine won't ARP for the remote machine so the remote MAC address won't be in the local ARP cache. Is it possible that nmap is finding the MAC address of the local router?
Thanks @joeqwerty , maybe its hard to get mac address
It's not neccessarily hard. You just need access to a device on the remote network that can issue an ARP query for the remote machine whose MAC address you want to find. Then you need to view the ARP cache of that remote querier. The remote querier can be the router, a switch or a machine on the remote network.
actually what i need: I want to find one kind of devices connected with the network. those devices own the same prefix MAC address for they are made in the same company, then i could get their IP address, and then access them with ip address.
I make a mistake, maybe nmap can not get mac address for different subnets too. you are right.
0 like 0 dislike

For the same subnet:

arp will display your machine's arp table, which will include the MAC address of clients it's communicated with. So, ping, then arp to make sure you get a MAC address from the desired client.

(Use arp /? for the help/usage display on the command)

For a different subnet:

getmac /s [ip]

(Uses RPC, so better be Windows and need permissions on the target computer, so really only useful in an enterprise environment.)

EDIT : (Come to think of it, you might try the nbtstat command as well, given Windows. May or may not work, depending on the networking settings and configs, but it certainly can pull MAC addresses from different subnets.)

answered Nov 12, 2014 by HopelessN00b  
edited Nov 12, 2014
i tried, arp can not get different network segment IPs
@peter Yeah, sorry about that, that's because of what joeqwerty said. I didn't read carefully enough (hazard of working and ServerFaulting at the same time), so I added the getmac bit. As far as native options go, that's all I'm aware of, so if that's insufficient, it might be time to grab nmap for Windows.
Thanks. getmac can not work well since RPC problems. and nbtstat can not work too, and it says "Host not found ".
0 like 0 dislike

There is nmap for windows, you can download from namp site. Just look for the windows version, it even come with a GUI.

For C#, you can use SendARP().

answered Nov 12, 2014 by John Siu  
Yes, nmap can work. But I donot want to install it and want to get MAC address in my program. thanks.
Updated for C#.
Thanks, for the same subnet network , i will try SendARP().
I donot know, my PC is on wlan, and devices are on ethernet. They are in differet subnet. and arp -s cannot work for different subnet
0 like 0 dislike

Assuming you know that the target is a Windows system, I would use WMI (the Windows CIM implementation) to accomplish this. Here is the same question answered for VB.Net, which is easy enough to translate to VC or C#. As the link says, be sure to import the System.Management and System.Management.Instrumentation namespaces.

Dim theManagementScope as new ManagementScope("\\" & ComputerName & "\root\cimv2")
Dim theQueryString as new string = "SELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = 1"

Dim theObjectQuery as new ObjectQuery(theQueryString)

Dim theSearcher as new ManagementObjectSearcher(theManagementScope, theObjectQuery)
Dim theResultsCollection as ManagementObjectCollection = theSearcher.Get()

for each currentResult as ManagementObject in theResultsCollection

It may also be possible to get the information from the DHCP server with DhcpEnumSubnetClients, DhcpEnumSubnetClientsV4 or DhcpEnumSubnetClientsV5. Not sure what kind of permissions you need to run that or if it has to be run from the DHCP server, though. Docs aren't very clear.

answered Nov 12, 2014 by Bacon Bits