Friday, May 22, 2020

[WINDOWS] question regarding "Last Update" value in output from 'netsh' command when listing neighbor cache entries (MAC addresses)

Unsure if this is the proper subreddit to ask in, but here goes...

I'm helping a coworker with a small inventory script that lists, sorts, and searches the entry list when issuing commands netsh interface ipv4 show neighbor level=verbose and netsh interface ipv6 show neighbor level=verbose

I am using level=verbose as it makes it slightly simpler to parse the the output.

Example entry in the output:

Neighbor 192.168.1.250 ---------------------------------------------- Datalink Address : 34-62-88-dc-36-c3 State : Reachable Last Update : 0 

My question is: what does the "Last Update" value denote? (It does not show in the regular non-verbose table output.)

After spending some time googling this I am not really getting anywhere. The verbose output mode on this command is not documented anywhere it seems. My coworker does not know, and said it's not necessary to include it in the script's processing. But I am still curious. I am assuming it's the age of the entry - or when the State was last changed, but I'd still like to know for sure.


Another curious thing is that when running the aforementioned commands in a cmd shell, "Last Update" will always show value "0" on all entries in the output (as shown above). Always.

But... if I run the command through a parent process (i.e. AutoIt), it will show an integer i.e. "55229928". This value is always different whenever the command is run, (but it is the same on all entries in the list).

Example when executed through AutoIt:

../.. Neighbor 192.168.1.250 ---------------------------------------------- Datalink Address : 34-62-88-dc-36-c3 State : Reachable Last Update : 7767808 Neighbor 192.168.1.251 ---------------------------------------------- Datalink Address : 34-62-88-dc-20-22 State : Reachable Last Update : 7767808 ../.. 

Any ideas?



No comments:

Post a Comment