Question

I am working on a tool a little like xARP. It simply detects changes in ARP tables to find out whether a man in the middle attack is taking place. Anyway, I ran into a problem. I managed to read the ARP table from my machine and load them into a string.

The problem now is that I am unable to seperate the MAC addresses from the other text the windows ARP-command outputs. How would one go about seperating only the MAC addresses and filtering out all the irrelevant text?

Answer 1

Two options: using regular expression (best!) or just using substring on every line. The output of windows ARP is correctly spaced to allow for substring.

Edit: For substring, you could first split the entire output into single lines, and then process each line sequentially. That way the indexes for substring stay the same for every line.

Edit: http://www.regular-expressions.info/ has great information on learning regular expressions.