Is any API to do that?
gethostname -> give me host name
what could I write to get my MAC when I am not connected to the network?
if I am connected, I send arp request to myself and get it.
Posted on 2004-01-15 04:29:19 by HarryTuttle
I want to know how ipconfig gets all the information after ipconfig /all direction?(I can get all without MAC )
I found a c source but 4 linux only and as you know library used in that system are little different than in windows. Could you post the source of ipconfig.c or ipconfig.asm 4 windows if you got it?


Posted on 2004-01-16 02:46:04 by HarryTuttle
There's more methods to get the mac than you can poke a stick at :grin:
Posted on 2004-01-16 04:26:44 by Homer
The older way and more machcanical way is to use the Netbios API. Given as an example from M$ website.

It works well from W95, W98, WME, NT4, W2K, XPpro.
I have not tried it on Server 2003 yet.

Are you looking to learn or just trying to find a pre-written solution?

Regards, P1 :cool:
Posted on 2004-01-16 12:45:59 by Pone
That netbios api method will not work when netbios is not enabled, which is likely to be a problem when querying for mac of NICs that are connected to the internet, since very few silly people leave netbios enabled on those interfaces, due to things like NULL session and SMB downgrading exploits.
Posted on 2004-01-17 10:17:57 by Homer

Are you looking to learn or just trying to find a pre-written solution?

Regards, P1 :cool:

to learn:)
I prefer documentation like RFC, short, essential, technical description but source code is sometime better
Please post those links you got;)
Posted on 2004-01-18 06:49:28 by HarryTuttle

You have me curious now.
Would you like to try my NetBios method display MAC address program for me?
I have never know this program fragment to fail yet. Not Even on a virtual PPP adapter which gives a MAC of "444553540000".

The worst is that it would give an error. The best is that M$ recommends this as a prefered method of getting the MAC address and it still works anyway on your system.
Originally found in MSDN Library
Network Basic Input/Output System (NetBIOS) defines a software interface and a naming convention, not a protocol.
So I am interested to see if this turns out. I do this stuff everyday for a living and would very much like to see if your right.

Regards, P1 :cool:


What you need is either, a MSDN Library CDs, or a Platform SDK to go through the basics of M$ OSes. In the mean time, use the websites:

Regards, P1 :cool:
Posted on 2004-01-19 13:50:07 by Pone
I'd be happy to test your code fragment.
Since you like to quote MSDN as the ultimate authority of m$ component software, allow me to kindly do the same:

This article demonstrates how to get the Media Access Control (MAC) address for an ethernet adapter programmatically by using NetBIOS, if your card is bound to NetBIOS.

This is taken from

Note that carefully: if the NIC has not been bound to NETBIOS (sic - if NETBIOS has not been bound to the NIC) then it won't work. This is quite clear, but we don't have to rely on the NETBIOS method, theres lots of others.
Posted on 2004-01-20 00:48:20 by Homer
the key is not that , the discusion skips the clue.;)
First I was searching for get my MAC method when I am not connected.

when I am connected i have NetBios (getmac.exe),ICMP (ping.exe myself and then arp-a), ARP (by my programm) and others.

when I am not connected the system has my MAC the NIC has its hardware and MAC inside the ROM.

I do not want to take it from NIC because it may be more tough than get it from system.

I need this because of an idea anticrack.

best regards,

btw:Do you know how to get HD serial?
Posted on 2004-01-20 02:52:23 by HarryTuttle
NIC=Network Interface Card, all network devices have one.
Your MAC address for a given NIC is hardcoded into the NIC.
That being said, the OS queries the NIC itself for the value at startup.
From then on, it uses the SOFTWARE version of the MAC.
As I understand it, subsequent queries are always to the OS cache and not to the device itself, although I could be wrong here, depending on the method chosen.
This is what allows us to forge a MAC, should we choose to.
The MAC retrieval should have nothing to do with your online status.
The MAC can be retrieved anytime.
All I was saying is that the NETBIOS method of querying a NIC's MAC WILL FAIL if NETBIOS isn't bound to that NIC.
As for querying a HDD for its hardware serial, try searching this board ;)
Posted on 2004-01-20 04:34:55 by Homer

This is what allows us to forge a MAC, should we choose to.

Doesn't the NIC itself add the MAC to the ethernet frames? Or is this done by software?
Posted on 2004-01-20 08:24:27 by f0dder
f0dder, if that was the case, MAC spoofing would not be possible, at least it wouldn't be possible without some kind of local router MITM, and I can tell you for a fact that its doable. This means that the tcp/ip stack uses a soft cached copy of the MAC, and that the MAC is not written on all outgoing packets by the NIC as we have often been lead to believe... for better or worse, we can forge MAC on outgoing packets. I can't think of a single decent reason to wish to do so, but I can tell you that some kids on cable networks like to charge their bandwidth to their peers... We can close this thread now if you like :)
Posted on 2004-01-20 08:38:53 by Homer
Interesting, I thought changing MAC involved flashing your NIC.
Posted on 2004-01-20 10:12:02 by f0dder

Interesting, I thought changing MAC involved flashing your NIC.

#include <stdlib.h>
#include <stdio.h>

#include <pcap.h>

void usage();

void main(int argc, char **argv) {
pcap_t *fp;
char error[PCAP_ERRBUF_SIZE];
u_char packet[100];
int i;

/* Check the validity of the command line */
if (argc != 2)
printf("usage: %s inerface", argv[0]);

/* Open the output adapter */
if((fp = pcap_open_live(argv[1], 100, 1, 1000, error) ) == NULL)
fprintf(stderr,"\nError opening adapter: %s\n", error);

/* Supposing to be on ethernet, set MAC destination to 1:1:1:1:1:1 */

/* set MAC source to 2:2:2:2:2:2 */

/* Fill the rest of the packet */

/* Send down the packet */


Posted on 2004-01-21 05:07:32 by HarryTuttle
well, well! You live, you learn :)

Haven't tested, but I assume it does what I expect it does.
Posted on 2004-01-21 08:20:18 by f0dder

Here is the NetBios method of get a MAC address from an adapter card ( includes source ).

I just checked it on Server 2003 and still works well.

So I am curious if it will run or not on your system with your given pre-cautions.

Regards, P1 :cool:
Posted on 2004-01-23 10:35:36 by Pone
I have my primary interface with no netbios, and secondary interface has no netbios, the cards are bridged, the result I got was the same mac for both devices, but I admit it did match one of the device macs, the lan card in fact, the secondary interface.
Posted on 2004-01-24 02:10:54 by Homer

I guess generating a matrix of technique by results by OS, would help determine usability for us network programmers.

If I understand you correctly, two NICs in one system, running two patch cables to the same Hub. Correct?

Regards, P1 :cool:
Posted on 2004-01-28 16:35:29 by Pone
No hub, one NIC connected to a cable modem, the other NIC servicing the LAN...
Posted on 2004-01-29 08:32:45 by Homer