Using the FileSystemObject to obtain a DHCP Client's MAC Address

By Brian Atkinson

This article will look into obtaining the MAC (Media Access Control) Address (see definition of MAC address) from a Network Adapter using one Active Server Page. There are two catches to this solution: The client must be using DHCP to obtain an IP Address, and IIS needs to be running on the same server that the DHCP services are running on. The ASP page will only obtain MAC addresses from clients that were issued an IP address from this same server.

- continued -

With these points clarified, we will move on to accomplishing the task at hand. All DHCP leases are logged in the \winnt\system32\dhcp\dhcpsrvlog.DAY file. The *.DAY extension represents any of seven possible extensions for this file - .Mon .Tue .Wed .Thu .Fri .Sat .Sun. Open any of these files in a text editor (except the one for the current day). Scroll down about fifteen lines, and you should see something like this:

ID,Date,Time,Description,IP Address,Host Name,MAC Address 11,12/25/99,00:04:00,Renew,255.255.255.255,testbench,00C0F0XXYYZZ

There is one little catch to getting information from the current DHCP log. The DHCP log currently in use for the day cannot be directly opened. In other words, dhcpsrvlog.Mon cannot be opened directly on Monday, because it is in use by the DHCP services. Copying it to another location is the way to avoid this problem. The last field of the comma-delimited database reveals the MAC address for the client's machine.

Now that we know this information exists, we can use the ASP to:

<% Option Explicit %> <% '<<<<< DECLARE ALL VARIABLES >>>>>' Dim sRIPa Dim sDate Dim intRandom Dim objFSO Dim objTextFile Dim sLine Dim sMacAddr '<<<<< OBTAIN CLIENT's IP ADDRESS >>>>>' sRIPa = Request.ServerVariables("REMOTE_ADDR") '<<<<< OBTAIN DATE AND FORMAT FOR APPROPRIATE DHCP LOG EXTENSION >>>>>' sDate = LEFT(FormatDateTime(Date, 1), 3) '<<<<< REDIRECT BAD IP RANGES TO APPROPRIATE PAGE >>>>>' If LEFT(sRIPa, 7) <> "255.255" Then Response.Redirect ("error_page.asp") End If '<<<<< CREATE TEMP FILE NAME - RANDOMLY GENERATED >>>>>' Randomize intRandom = Int((99999 - 11111 + 1) * Rnd + 1) '<<<<< COPY THE DHCP LOG TO WORKING DIRECTORY>>>>>' Set objFSO = Server.CreateObject("Scripting.FileSystemObject") objFSO.CopyFile "C:\winnt\system32\dhcp\DhcpSrvLog." & _ sDate, "C:\working\" & intRandom & ".txt" Set objFSO = Nothing '<<<<< OBTAIN THE MAC ADDRESS FROM THE COPIED DHCP LOG >>>>>' Set objFSO = Server.CreateObject("Scripting.FileSystemObject") Set objTextFile = objFSO.OpenTextFile("C:\working\" & _ intRandom & ".txt") Do While Not objTextFile.AtEndOfStream sLine = objTextFile.ReadLine If InStr(sLine, sRIPa) Then sMacAddr = LCASE(RIGHT(sLine,12)) End If Loop '<<<<< CLEAN UP AND DELETE THE TEMPORARY FILE >>>>>' objTextFile.Close Set objTextFile = Nothing objFSO.DeleteFile ("C:\working\" & intRandom & ".txt") Set objFSO = Nothing '<<<<< FORMAT THE MAC ADDRESS >>>>>' sMacAddr = LEFT(sMacAddr, 4) & "." & MID(sMacAddr, 5, 4) & "." & RIGHT(sMacAddr, 4) '<<<<< GENERATE THE HTML OUTPUT >>>>>' Response.Write ("<HTML><FORM><TABLE BORDER=0 ALIGN=LEFT><TR><TD>") Response.Write ("<B>IP Address:</B></TD><TD><INPUT TYPE='TEXT'") Response.Write (" SIZE=15 VALUE='" & sRIPa & "'>") Response.Write ("</TD></TR>") Response.Write ("<TR><TD><B>MAC Address:</B> </TD><TD>") Response.Write ("<INPUT TYPE=TEXT SIZE=15 VALUE='" & sMacAddr) Response.Write ("'></TD>") Response.write ("</TR></TABLE></FORM></HTML>") %>

This should do the trick. I have used this technique to successfully obtain MAC addresses for Windows 9x/NT, Macintosh and Linux boxes. Macintosh clients sometimes have much longer MAC addresses entries in the DHCP log, but the last 12 characters are always the MAC address.

NTFS permissions required for this example to work:
IUSR must have READ to the \winnt\system32\dhcp folder
IUSR must have READ, WRITE and DELETE to the \working folder

Attachments:

Download the source code in text format