ArpLookup

ArpLookup is a .Net Standard 2.0 library that provides Lookup and LookupAsync methods to find the MAC address corresponding to an IP address on Windows and Linux.

This library is feature-complete according to the current planning. So no frequent updates are expected, although it is actively maintained.

Download

• NuGet Package
  • PM> Install-Package ArpLookup or dotnet add package ArpLookup
• GitHub Releases for the .nupkg and .snupkg files.

Usage

This library currently provides one single, simple to use function (once sync, once async; only truly async on Linux, see below):

using System.Net.NetworkInformation;
using ArpLookup;

// ...

PhysicalAddress mac = Arp.Lookup(IPAddress.Parse("1.2.3.4"));

PhysicalAddress mac = await Arp.LookupAsync(IPAddress.Parse("1.2.3.4"));

To detect if the current platform is supported, check as follows. Lookups on unsupported platforms throw PlatformNotSupportedExceptions.

var linuxOrWindows = Arp.IsSupported;

Further information

On Windows an API call to IpHlpApi.SendARP is used. Beware that this implementation is not truly async but just returns a finished task containing the result. Consider calling wrapped in Task.Run if the sync executing is not acceptable in your use case.

On Linux the /proc/net/arp file, which contains system's the arp cache, is read. If the IP address is found there the corresponding MAC address is returned directly. Otherwise, an ICMP ping is sent to the given IP address and the arp cache lookup is repeated afterwards. This implementation uses async file IO and the framework's async ping implementation.

By default, the library waits for ping responses for up to 750ms on Linux platforms. Technically, the responses are not required, as the arp protocol and the arp cache have nothing to do with the pings. Rather, the pings are an easy way to force the OS to figure out and provide the information we are looking for. I did not do extensive tests how long is reasonable to wait to be quite sure, the arp cache is updated. 750ms should be much more than needed in many cases - it is more of the safe option. Note that if you do recieve a ping response, the wait might be much shorter. The timeout comes into effect if the host is not available or does not respond to the ping. If you want to request many addresses or are facing other time-limiting aspects, you may want to reconfigure this default:

Arp.LinuxPingTimeout = TimeSpan.FromMilliseconds(125);

Local NIC's MAC addresses

Please note that this library was designed to determine the MAC addresses of remote devices. Under certain circumstances, the Lookup or LookupAsync function may return the MAC addresses of local NICs as well. However, this behavior varys across different platforms. To lookup local MAC addresses, a library like this is not necessary, but existing APIs of .Net can be used:

using System.Net;
using System.Net.NetworkInformation;

List all NICs and their IPv4s and MAC addresses:

foreach (
    var nic in NetworkInterface
      .GetAllNetworkInterfaces()
      .Where(nic => nic.OperationalStatus == OperationalStatus.Up
                    && nic.NetworkInterfaceType != NetworkInterfaceType.Loopback)
    )
{
    var ips = nic.GetIPProperties().UnicastAddresses
        .Where(adr => adr.Address.AddressFamily == System.Net.Sockets.AddressFamily.InterNetwork)
        .Select(adr => adr.Address.ToString());
    Console.WriteLine($"{string.Join(", ", ips)} {nic.GetPhysicalAddress()} {nic.Name}");
}

Lookup one MAC address by IPv4 address:

var ip = IPAddress.Parse("192.168.1.2");

var nic2 = NetworkInterface
    .GetAllNetworkInterfaces()
    .Where(nic => nic.OperationalStatus == OperationalStatus.Up
                  && nic.NetworkInterfaceType != NetworkInterfaceType.Loopback)
    .Where(nic => nic.GetIPProperties().UnicastAddresses.Any(adr => adr.Address.Equals(ip)))
    .FirstOrDefault();

Console.WriteLine($"HWAddr for IP {ip} is {nic2?.GetPhysicalAddress()?.ToString() ?? "UNKNOWN"}");

Supported platforms

• Windows (tested)
• Linux
  • Debian (tested)
  • Android
  • not WSL 1 (tested)
  • WSL 2

Note that the used method does not work in WSL 1 and might not work on every Linux distribution. Checking the Arp.IsSupported property accounts for this (though it does not check if you are actually allowed to access /proc/net/arp). In WSL 2 this library will work as on most "real" Linux distributions as this issue describes. While I did not test this library on Android/Xamarin I have read in different places that reading /proc/net/arp is possible (given the right permissions).