I have the following code:

arp-scan -l > temp_scan.log
cat temp_scan.log | while read line
        for f in $FILES
                echo "--------------------------------"
                ADDR=$(cat $FILES)
                MAC=$(echo $line | grep -o -E '([[:xdigit:]]{1,2}:){5}[[:xdigit:]]{1,2}')
                sleep 0.1
                #echo "$ADDR"
                echo "$MAC"

                if [[ "$ADDR" == "$MAC" ]]
                        echo "found"
                        echo "not fount"

In the known folder is a file name Router which has the MAC address. The variables are the same at one point but the if statement apparently does not work. I spent 4 hours trying to understand what is wrong but I cannot see anything..

  • please show the contents of the Router and temp_scan.log files. – glenn jackman Aug 12 '14 at 20:25
  • Are you absolutely sure that the two strings are the same here? You could potentially have leading or trailing whitespaces. Also, is the MAC address the only thing on the line, because if it isn't this statement: MAC=$(echo $line | grep -o -E '([[:xdigit:]]{1,2}:){5}[[:xdigit:]]{1,2}') is not adequate to isolate it. It should probably look like this: MAC=$(echo $line | sed 's/(([[:xdigit:]]{1,2}:){5}[[:xdigit:]]{1,2})/\1/g'), assuming your reg-ex pattern is valid. – James Lui Aug 12 '14 at 20:28
  • Router contains the mac address "xx:xx:xx:xx:xx:xx" and temp_scan.log contains the scan resoults " xx:xx:xx:xx:xx:xx (Unknown)". – ZaBiC Aug 12 '14 at 20:29
  • Hello James, there are no whitespaces as far as I can see. I tried your suggestion and it did not work. – ZaBiC Aug 12 '14 at 20:33
  • Reading your code again, I'm assuming that you want to go through a certain amount of files within $FILES, you set $ADDR to the result of the cat $FILES, do you mean to do $ADDR=$(cat $f)? – James Lui Aug 12 '14 at 20:38

I found the problem!!

It seems that while arp-scan is running, it shows the MAC address differently from time to time.

For example if I scan the network now, it will show my router like this: xx:xx:xx:xx:xx:xx (Unknown)

After a few scans the router will appear as: xx:xx:xx:xX:xX:xx (Unknown)

Some letters are uppercase. I think I messed up linux. So I found the answer to my problem. I will convert all letter to lowercase for the comparison.

Sorry for disturbing!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.