macos fail arp if first two char mac found and then one digit mac tested

[raymanP]

On macOS getmac does not return the MAC of some IP, however, using arp -n IP retuns the MAC successfully

macOS 14.0
Apple M1 chip
getmac 0.9.4

[GhostofGoes]

Can you run the command with debugging enabled, and share the output?

getmac -v -dddd -4 <ip>

[raymanP]

It seems arp is used however this is returned:

DEBUG    Attempting to populate ARP table with UDP packet to 192.168.2.122:55555
DEBUG    Attempting get() (method='ArpVariousArgs', method_type='ip4', arg='192.168.2.122')
DEBUG    Running: '/usr/sbin/arp  192.168.2.122'
DEBUG    Output from '/usr/sbin/arp' command: b'localhost (192.168.2.122) at 0:2:1:71:8b:5e on en5 ifscope [ethernet]\n'
DEBUG    Method 'ArpVariousArgs' failed for 'ip4' lookup
DEBUG    Raw MAC found: None
DEBUG    getmac took 0.0154 seconds

This is outoput from Eclipse within a Thread.
When using command line or other circumstances, getmac seems to work rightly.

[raymanP]

I found now the root couse for the problem:

        # try linux regex first
        # try darwin regex next
        #   if a regex succeeds the first time, cache the successful regex
        #   otherwise, don't bother, since it's a miss anyway
        for regex in (self._regex_std, self._regex_darwin):
            # NOTE: Darwin regex will return MACs without leading zeroes,
            # e.g. "58:6d:8f:7:c9:94" instead of "58:6d:8f:07:c9:94"
            found = _search(r"\(" + escaped + regex, command_output)
            if found:
                self._good_regex = regex
                return found

Here on macOS if multiple ip's are tested and first is one with two chars each, e.g. '2c:16:db:af:4a:1d'
the linux version is cached and when a mac with one char comes, e.g.'2:12:ba:af:da:1d', it is not found.

The solution in my opinion should be either to use the macos version which fits also the linux version or to use platform.system()=='Darwin' to select the macOS regex at __init__

[GhostofGoes]

That makes sense. There's no point to testing when we already know the platform. Can you post a sample of the output of running /usr/sbin/arp 192.168.2.12, as well as /usr/sbin/arp (no arguments)? Please scramble IPs/MACs to alternative values if they're sensitive.

Unfortunately I don't have reliable access to a Mac to test with (Vagrant VM is flaky and my 10 year old Mac Air is basically a dinosaur at this point).

[raymanP]

/usr/sbin/arp 192.168.2.122 returns localhost (192.168.2.122) at 0:2:1:71:8b:5e on en5 ifscope [ethernet]

and /usr/sbin/arp returns

usage: arp [-n] [-i interface] hostname
       arp [-n] [-i interface] [-l] -a
       arp -d hostname [pub] [ifscope interface]
       arp -d [-i interface] -a
       arp -s hostname ether_addr [temp] [reject] [blackhole] [pub [only]] [ifscope interface]
       arp -S hostname ether_addr [temp] [reject] [blackhole] [pub [only]] [ifscope interface]
       arp -f filename

I added a Pull request #93 tested with mac

[GhostofGoes]

This is fixed in release 0.9.5