Monday, March 26, 2012

NET_ADDRESS in the master.dbo.sysprocesses table

Does anyone knows how the field NET_ADDRESS in the master.dbo.sysprocesses table is encoded ?
May I extract the IP address or MAC address from that field ?

Just ran it on my own computer. NET_ADDRESS is the MAC address of my network card. The only way I know to correlate this to an IP address would be to somehow get it from the DHCP server.

As I understand it, the only computer name/ip address in SQL Server is HOSTNAME and that's voluntarily provided by the client and the client can make up any name it wants.

|||I had the same thought as you but my sql server reports strange values for some PC:
B7D36284FF31 MICHELENEW

CBB6ACE3C807 CARLOP
are clearly strange values, CBB6ACE3C807 is My PC and my MAC is 00-0E-A6-1D-BE-29

do you have any idea about ?

here the complete report from master.dbo.sysprocesses table

NET_ADDRESS HOSTNAME
-

00096B67790E SERVER2003
000EA61DBBCE NICOLA
000EA61DBD4D EMANUELEXP
000EA61DBEFF MICHELENEW
000EA61DC006 ENRICO02
000EA6C49C83 BAMBINO999
000EA6C71205 DOMEXP
000EA6D0B069 MICHELA2
000FEA8184A8 ACQUARIO7
000FEA855CAC ACQUARIO8
00105AB3BBB1 MAURIZIO
00112FDCA644 FF
00142A98601E ROBERTO
00304841C27D ETEREW7
0030485449F5 MASSIMOXP
003048584C64 ETEREW10
0060082CE6D6 LAURAXP2
00D0B7E28366 ACQUARIO9
B7D36284FF31 MICHELENEW
CBB6ACE3C807 CARLOP|||

If you happen to be on SQL Server 2005, you can find out a lot more with;

select * from sys.dm_exec_connections

/Kenneth

|||I'm on 2000, but anyway thanks for the info, I will keep it in mind for the future. Thanks.|||1) If the net_Address starts with 00 the program which opened the connection is running in a simple environment or is a regular connection. If you have letter is because the connection was opened from SQl Analyzer or a server which shared sessions. Like using Terminal server or Remote desktop connection.

000EA61DBEFF MICHELENEW
B7D36284FF31 MICHELENEW

The "good" MAC address is 00-0E-...

2) How to map back the net_Address (MAC) to IP.
In any domain controller from the DOS command type:

ARP -a

look for your MAC address in the list. I know this is a pain but the point is that U can get the info from DHCP. Maybe a script could help. Remembert ARP is a cache list but it helps.

3) From SQL Server type
select net_address,loginame,hostname nt_username, * from master..sysprocesses order by net_address
It can help you to figure it our who is using the connection.sql

No comments:

Post a Comment