Never mind =] sorry. I found a way with IPHLPAPI http://www.dotnet247.com/247reference/msgs/18/91898.aspx
Daniel ----- Original Message ----- From: "Guy Harris" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Thursday, July 03, 2003 9:34 AM Subject: Re: [WinPcap-users] Need a simple way to get destination mac address > On Tue, Jul 01, 2003 at 04:33:57PM +0100, Daniel Frimerman wrote: > > Thing is, I just used raw sockets to send tcp packets to a big list of IP > > addresses. When I sniffed (Ethereal) the network I saw a few ARP packets > > coming in and out, but that's nothing compared to how many packets I've sent > > out. > > > > So what does Windows do to send it out? I use Cable, maybe it sends it to > > the mac address of the router on the ISP? > > If the first hop on the path of an IP packet to its destination is on a > broadcast LAN (Ethernet, FDDI, Token Ring, IEEE 802.11, etc.), the MAC > address on the packet, on that first hop, is probably to the destination > machine if it's on the same LAN segment or to a router on that LAN > segment if the destination machine isn't on the same LAN segment. > > Windows - and most if not all other OSes - get that address by sending > out an ARP packet *if* it doesn't already have the MAC address, and uses > the address it has if it does already have it. (I.e., you should *not* > assume the number of ARP packets will necessarily be equal to the number > of packets you've sent.) If the machines aren't all on your LAN > segment, and the same router is used to route all of them to their > destinations, only one ARP will be needed - the one to get the MAC > address of the router. > > > ================================================================== > This is the WinPcap users list. It is archived at > http://www.mail-archive.com/[EMAIL PROTECTED]/ > > To unsubscribe use > mailto: [EMAIL PROTECTED] > ================================================================== > ================================================================== This is the WinPcap users list. It is archived at http://www.mail-archive.com/[EMAIL PROTECTED]/ To unsubscribe use mailto: [EMAIL PROTECTED] ==================================================================
