# Obtain src/dst mac addrs from connection record **URL:** \ **Category:** Zeek\ **Created:** [January 31, 2012, 10:47pm UTC](https://community.zeek.org/t/obtain-src-dst-mac-addrs-from-connection-record/2206 "2012-01-31T22:47:00Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Pete](https://avatars.discourse-cdn.com/v4/letter/p/3ab097/32.png) [@Pete](https://community.zeek.org/u/Pete)\ **Post date:** [January 31, 2012, 10:47pm UTC](https://community.zeek.org/t/obtain-src-dst-mac-addrs-from-connection-record/2206/1 "2012-01-31T22:47:00Z")
Is there a way to obtain the source and/or destination mac address from a connection record? I've been looking through the scripts and BIFs, but am not seeing anything. I'm wondering it I missed something. The way it's looking right now, I'll have to use an ARP script (which I posted to the list in November) or use the get\_current\_packet() to extract the appropriate offsets. ---
**Author:** ![Seth\_Hall3](https://avatars.discourse-cdn.com/v4/letter/s/d6d6ee/32.png) [@Seth\_Hall3](https://community.zeek.org/u/Seth_Hall3)\ **Post date:** [February 1, 2012, 2:54am UTC](https://community.zeek.org/t/obtain-src-dst-mac-addrs-from-connection-record/2206/2 "2012-02-01T02:54:45Z")
You didn't miss anything. There is actually a very good reason that the MAC addresses aren't available. Ethernet has no notion of a connection so a single connection could involve any number of IP addresses. The connection you are looking into may not even be over ethernet so no MAC addresses would be available. In most "normal" cases of border sniffing you will only see the MAC addresses of two routers anyway. That said... you could probably make it work by writing a script that uses the ARP analyzer to create MAC-\>IP address mappings and then looking up the MAC address that is using a particular IP address. You could even extend the conn.log file with orig\_mac and resp\_mac fields so that the MAC addresses would be located there. I don't think that's something we would ship with Bro directly due to how deployment specific it would be (would work great on LAN span ports, but for border sniffing it would be useless). It would be nice to have a script like that for our contributed scripts repository though!   .Seth ---
**Author:** ![Matthias\_Vallentin1](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/matthias_vallentin1/32/596_2.png) [@Matthias\_Vallentin1](https://community.zeek.org/u/Matthias_Vallentin1)\ **Post date:** [February 1, 2012, 3:33am UTC](https://community.zeek.org/t/obtain-src-dst-mac-addrs-from-connection-record/2206/3 "2012-02-01T03:33:27Z")
We have a script in the Bro scripts repository that collects IP to MAC mappings via DHCP ACKs and ARP replies:     [http://git.bro-ids.org/bro-scripts.git/blob/HEAD:/roam.bro](http://git.bro-ids.org/bro-scripts.git/blob/HEAD:/roam.bro)     Matthias ---
**Author:** ![Pete](https://avatars.discourse-cdn.com/v4/letter/p/3ab097/32.png) [@Pete](https://community.zeek.org/u/Pete)\ **Post date:** [February 1, 2012, 8:39pm UTC](https://community.zeek.org/t/obtain-src-dst-mac-addrs-from-connection-record/2206/4 "2012-02-01T20:39:46Z")
\*\* Seth Hall \ [2012-01-31 21:54:45 -0500] \*\* > \> Is there a way to obtain the source and/or destination mac address from > \> a connection record? I've been looking through the scripts and BIFs, but > \> am not seeing anything. I'm wondering it I missed something. > > You didn't miss anything. There is actually a very good reason that > the MAC addresses aren't available. Ethernet has no notion of a > connection so a single connection could involve any number of IP > addresses. The connection you are looking into may not even be over > ethernet so no MAC addresses would be available. In most "normal" > cases of border sniffing you will only see the MAC addresses of two > routers anyway. I figured that was the reason, but never hurts to ask. > That said... you could probably make it work by writing a script that > uses the ARP analyzer to create MAC-\>IP address mappings and then > looking up the MAC address that is using a particular IP address. You > could even extend the conn.log file with orig\_mac and resp\_mac fields > so that the MAC addresses would be located there. I don't think > that's something we would ship with Bro directly due to how deployment > specific it would be (would work great on LAN span ports, but for > border sniffing it would be useless). It would be nice to have a > script like that for our contributed scripts repository though! For the reasons that you just said, I'm hesitant to add mac addresses to the conn.log because it won't make much sense for 90% of all the traffic. However, as mentioned offline, I'm re-writing the dhcp script from pre-2.0 and identifying possible relays will be much easier with the ip to mac addr mappings. So, with that said, I'll just use the arp script that I previously provided. Thanks for the feedback. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/obtain-src-dst-mac-addrs-from-connection-record/2206/5 "2022-05-06T15:40:09Z")