#!/usr/bin/perl -w
#
# Search arp.dat for given MAC addresses, in any format.
# 2001-12-11  Jean Delvare  <delvare@ensicaen.ismra.fr>

# Change this if your data file is located elsewhere.
use constant ARP_DAT => '/usr/local/arpwatch/arp.dat';

use strict;
use vars qw(%hip %hname %hmac);

# Source looks like this: 0:2:55:90:ca:d
# We pad with 0's and strip the columns to obtain: 00025590ca0d
# Works also if padding isn't requied, and even if columns aren't present.
sub pad_mac {
	my @items=split(/:/,lc($_[0]));
	foreach my $cell (@items) { $cell =~ s/^(.)$/0$1/; };
	return(join('',@items));
}

# Fill %hip and %hname from arp.dat.
open(ARP,ARP_DAT) || die('File not found');
while(<ARP>)
{
	if(m/^\s*([\d\w:]+)\s+([\d\.]+)\s+\d+\s*([\w\d]*)/)
	{
		my $padded=pad_mac($1);
		$hip{$padded}=$2;
		$hname{$padded}=$3;
	}
}
close(ARP);

if(@ARGV)
{
	printf("\%-20s \%-18s \%-s\n",'MAC address','IP address','hostname');
}
else
{
	printf("Usage: $0 macaddr1 [macaddr2 [macaddr3...]]\n");
}

# Fill %hmac from command line.
foreach my $item (@ARGV)
{
	$hmac{$item}++;
}

foreach my $item (sort keys %hmac)
{
	$item=pad_mac($item);
	
	my $mac=$item;
	$mac =~ s/..\B/$&:/g;
	printf("\%-20s ",$mac);
	
	if(defined($hip{$item}))
	{
		printf("\%-18s \%-s\n",$hip{$item},$hname{$item});
	}
	else
	{
		print("[never seen]\n");
	}
}