{"action":"created","comment":{"url":"https://api.github.com/repos/facebook/osquery/pulls/comments/94073392","pull_request_review_id":14603970,"id":94073392,"diff_hunk":"@@ -0,0 +1,111 @@\n+/*\n+*  Copyright (c) 2014-present, Facebook, Inc.\n+*  All rights reserved.\n+*\n+*  This source code is licensed under the BSD-style license found in the\n+*  LICENSE file in the root directory of this source tree. An additional grant\n+*  of patent rights can be found in the PATENTS file in the same directory.\n+*\n+*/\n+\n+#include <boost/range/algorithm/find.hpp>\n+#include <osquery/tables.h>\n+#include <string>\n+\n+#include \"boost/algorithm/string/replace.hpp\"\n+#include \"osquery/core/conversions.h\"\n+#include \"osquery/core/windows/wmi.h\"\n+#include \"osquery/tables/networking/windows/interfaces.h\"","path":"osquery/tables/networking/windows/arp_cache.cpp","position":18,"original_position":18,"commit_id":"a4dd03284319c65edf8455933806ca7aa7a9d7ab","original_commit_id":"a4dd03284319c65edf8455933806ca7aa7a9d7ab","user":{"login":"PoppySeedPlehzr","id":1328916,"avatar_url":"https://avatars.githubusercontent.com/u/1328916?v=3","gravatar_id":"","url":"https://api.github.com/users/PoppySeedPlehzr","html_url":"https://github.com/PoppySeedPlehzr","followers_url":"https://api.github.com/users/PoppySeedPlehzr/followers","following_url":"https://api.github.com/users/PoppySeedPlehzr/following{/other_user}","gists_url":"https://api.github.com/users/PoppySeedPlehzr/gists{/gist_id}","starred_url":"https://api.github.com/users/PoppySeedPlehzr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/PoppySeedPlehzr/subscriptions","organizations_url":"https://api.github.com/users/PoppySeedPlehzr/orgs","repos_url":"https://api.github.com/users/PoppySeedPlehzr/repos","events_url":"https://api.github.com/users/PoppySeedPlehzr/events{/privacy}","received_events_url":"https://api.github.com/users/PoppySeedPlehzr/received_events","type":"User","site_admin":false},"body":"Sorry for the extra nit, we typically try to order our header includes from broadest scope to least scope, and also keep headers living in our include dir wrapped in '<', '>' and quotes for path includes. For this setup I think this might be good:\r\n```\r\n#include <string>\r\n\r\n#include <boost/range/algorithm/find.hpp>\r\n#include <boost/algorithm/string/replace.hpp>\r\n\r\n#include <osquery/tables.h>\r\n\r\n#include \"osquery/core/conversions.h\"\r\n#include \"osquery/core/windows/wmi.h\"\r\n#include \"osquery/tables/networking/windows/interfaces.h\"\r\n```","created_at":"2016-12-28T20:18:58Z","updated_at":"2016-12-28T20:18:58Z","html_url":"https://github.com/facebook/osquery/pull/2839#discussion_r94073392","pull_request_url":"https://api.github.com/repos/facebook/osquery/pulls/2839","_links":{"self":{"href":"https://api.github.com/repos/facebook/osquery/pulls/comments/94073392"},"html":{"href":"https://github.com/facebook/osquery/pull/2839#discussion_r94073392"},"pull_request":{"href":"https://api.github.com/repos/facebook/osquery/pulls/2839"}}},"pull_request":{"url":"https://api.github.com/repos/facebook/osquery/pulls/2839","id":96425800,"html_url":"https://github.com/facebook/osquery/pull/2839","diff_url":"https://github.com/facebook/osquery/pull/2839.diff","patch_url":"https://github.com/facebook/osquery/pull/2839.patch","issue_url":"https://api.github.com/repos/facebook/osquery/issues/2839","number":2839,"state":"open","locked":false,"title":"[windows] arp_cache virtual table","user":{"login":"svmastersamurai","id":680210,"avatar_url":"https://avatars.githubusercontent.com/u/680210?v=3","gravatar_id":"","url":"https://api.github.com/users/svmastersamurai","html_url":"https://github.com/svmastersamurai","followers_url":"https://api.github.com/users/svmastersamurai/followers","following_url":"https://api.github.com/users/svmastersamurai/following{/other_user}","gists_url":"https://api.github.com/users/svmastersamurai/gists{/gist_id}","starred_url":"https://api.github.com/users/svmastersamurai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/svmastersamurai/subscriptions","organizations_url":"https://api.github.com/users/svmastersamurai/orgs","repos_url":"https://api.github.com/users/svmastersamurai/repos","events_url":"https://api.github.com/users/svmastersamurai/events{/privacy}","received_events_url":"https://api.github.com/users/svmastersamurai/received_events","type":"User","site_admin":false},"body":"This should implement https://github.com/facebook/osquery/issues/2647\r\nWindows actually has a WMI class for this as of Server 2012/Windows 8+. It does ARP for v4 addresses but it will also return v6 addresses. If you just want the arp table you can filter out the v6 addresses 😆 \r\n\r\n```shell\r\nosquery> select * from arp_cache where address_family = 'IPv4' limit 5;\r\n+-----------------+-----------------+-----------------+--------------------+--------+-----------+----------------+\r\n| interface_index | interface_alias | ip_address      | link_layer_address | store  | state     | address_family |\r\n+-----------------+-----------------+-----------------+--------------------+--------+-----------+----------------+\r\n| 8               | Ethernet 2      | 255.255.255.255 | FF-FF-FF-FF-FF-FF  | Active | Permanent | IPv4           |\r\n| 8               | Ethernet 2      | 239.255.255.250 | 01-00-5E-7F-FF-FA  | Active | Permanent | IPv4           |\r\n| 8               | Ethernet 2      | 224.0.0.252     | 01-00-5E-00-00-FC  | Active | Permanent | IPv4           |\r\n| 8               | Ethernet 2      | 224.0.0.251     | 01-00-5E-00-00-FB  | Active | Permanent | IPv4           |\r\n| 8               | Ethernet 2      | 224.0.0.22      | 01-00-5E-00-00-16  | Active | Permanent | IPv4           |\r\n+-----------------+-----------------+-----------------+--------------------+--------+-----------+----------------+\r\n```\r\n\r\n```shell\r\nosquery> select * from arp_cache limit 5;\r\n+-----------------+------------------+-------------------+--------------------+--------+-----------+----------------+\r\n| interface_index | interface_alias  | ip_address        | link_layer_address | store  | state     | address_family |\r\n+-----------------+------------------+-------------------+--------------------+--------+-----------+----------------+\r\n| 2               | iphttpsinterface | ff02::16          | 33-33-FF-00-2A-EC  | Active | Permanent | IPv6           |\r\n| 2               | iphttpsinterface | ff02::2           | 33-33-FF-00-2A-EC  | Active | Permanent | IPv6           |\r\n| 8               | Ethernet 2       | ff02::1:ff00:2aec | 33-33-FF-00-2A-EC  | Active | Permanent | IPv6           |\r\n| 8               | Ethernet 2       | ff02::1:ff00:200e | 33-33-FF-00-20-0E  | Active | Permanent | IPv6           |\r\n| 8               | Ethernet 2       | ff02::1:ff00:2004 | 33-33-FF-00-20-04  | Active | Permanent | IPv6           |\r\n+-----------------+------------------+-------------------+--------------------+--------+-----------+----------------+\r\n```\r\n\r\nAlso with respect to the `permanent` table in the POSIX version, Windows catalogues that a bit differently by storing this information in the IP's `state`.  I guess if you just want the permanent ones you can filter it out, eh? 😃 \r\n```shell\r\nosquery> select count(*) from arp_cache where state='Permanent';\r\n+----------+\r\n| count(*) |\r\n+----------+\r\n| 49       |\r\n+----------+\r\nosquery> select count(*) from arp_cache where state<>'Permanent';\r\n+----------+\r\n| count(*) |\r\n+----------+\r\n| 554      |\r\n+----------+\r\n```\r\n\r\nGiven I am good enough at C++ to be dangerous to others, I originally had the mapping constants (e.g. `mapOfState`) as functions because that was old school before we had fancy things like `std::map`... The maps are easier on the eyes but increase risk of crashing if an index doesn't have one of the expected values. Of course we can assume they'll always be set but that is a dangerous thing to bank on 😨 Any advice on how to make that eloquently safer would be appreciated!\r\n\r\nAlso if you wanted this using the actual Win32 API that is fine too, I know some folks eventually want this backported and this is only workable on Server 2012 and up 😞 Now that I know where you hid the debug build symbols I might be able to float that too, but it'll take me a bit longer ;)","created_at":"2016-12-04T08:29:07Z","updated_at":"2016-12-28T20:18:58Z","closed_at":null,"merged_at":null,"merge_commit_sha":"6999b012e96d0532217580929b0b5a763d4a54a0","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/facebook/osquery/pulls/2839/commits","review_comments_url":"https://api.github.com/repos/facebook/osquery/pulls/2839/comments","review_comment_url":"https://api.github.com/repos/facebook/osquery/pulls/comments{/number}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/2839/comments","statuses_url":"https://api.github.com/repos/facebook/osquery/statuses/a4dd03284319c65edf8455933806ca7aa7a9d7ab","head":{"label":"svmastersamurai:win_arp_table","ref":"win_arp_table","sha":"a4dd03284319c65edf8455933806ca7aa7a9d7ab","user":{"login":"svmastersamurai","id":680210,"avatar_url":"https://avatars.githubusercontent.com/u/680210?v=3","gravatar_id":"","url":"https://api.github.com/users/svmastersamurai","html_url":"https://github.com/svmastersamurai","followers_url":"https://api.github.com/users/svmastersamurai/followers","following_url":"https://api.github.com/users/svmastersamurai/following{/other_user}","gists_url":"https://api.github.com/users/svmastersamurai/gists{/gist_id}","starred_url":"https://api.github.com/users/svmastersamurai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/svmastersamurai/subscriptions","organizations_url":"https://api.github.com/users/svmastersamurai/orgs","repos_url":"https://api.github.com/users/svmastersamurai/repos","events_url":"https://api.github.com/users/svmastersamurai/events{/privacy}","received_events_url":"https://api.github.com/users/svmastersamurai/received_events","type":"User","site_admin":false},"repo":{"id":75452144,"name":"osquery","full_name":"svmastersamurai/osquery","owner":{"login":"svmastersamurai","id":680210,"avatar_url":"https://avatars.githubusercontent.com/u/680210?v=3","gravatar_id":"","url":"https://api.github.com/users/svmastersamurai","html_url":"https://github.com/svmastersamurai","followers_url":"https://api.github.com/users/svmastersamurai/followers","following_url":"https://api.github.com/users/svmastersamurai/following{/other_user}","gists_url":"https://api.github.com/users/svmastersamurai/gists{/gist_id}","starred_url":"https://api.github.com/users/svmastersamurai/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/svmastersamurai/subscriptions","organizations_url":"https://api.github.com/users/svmastersamurai/orgs","repos_url":"https://api.github.com/users/svmastersamurai/repos","events_url":"https://api.github.com/users/svmastersamurai/events{/privacy}","received_events_url":"https://api.github.com/users/svmastersamurai/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/svmastersamurai/osquery","description":"SQL powered operating system instrumentation, monitoring, and analytics.","fork":true,"url":"https://api.github.com/repos/svmastersamurai/osquery","forks_url":"https://api.github.com/repos/svmastersamurai/osquery/forks","keys_url":"https://api.github.com/repos/svmastersamurai/osquery/keys{/key_id}","collaborators_url":"https://api.github.com/repos/svmastersamurai/osquery/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/svmastersamurai/osquery/teams","hooks_url":"https://api.github.com/repos/svmastersamurai/osquery/hooks","issue_events_url":"https://api.github.com/repos/svmastersamurai/osquery/issues/events{/number}","events_url":"https://api.github.com/repos/svmastersamurai/osquery/events","assignees_url":"https://api.github.com/repos/svmastersamurai/osquery/assignees{/user}","branches_url":"https://api.github.com/repos/svmastersamurai/osquery/branches{/branch}","tags_url":"https://api.github.com/repos/svmastersamurai/osquery/tags","blobs_url":"https://api.github.com/repos/svmastersamurai/osquery/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/svmastersamurai/osquery/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/svmastersamurai/osquery/git/refs{/sha}","trees_url":"https://api.github.com/repos/svmastersamurai/osquery/git/trees{/sha}","statuses_url":"https://api.github.com/repos/svmastersamurai/osquery/statuses/{sha}","languages_url":"https://api.github.com/repos/svmastersamurai/osquery/languages","stargazers_url":"https://api.github.com/repos/svmastersamurai/osquery/stargazers","contributors_url":"https://api.github.com/repos/svmastersamurai/osquery/contributors","subscribers_url":"https://api.github.com/repos/svmastersamurai/osquery/subscribers","subscription_url":"https://api.github.com/repos/svmastersamurai/osquery/subscription","commits_url":"https://api.github.com/repos/svmastersamurai/osquery/commits{/sha}","git_commits_url":"https://api.github.com/repos/svmastersamurai/osquery/git/commits{/sha}","comments_url":"https://api.github.com/repos/svmastersamurai/osquery/comments{/number}","issue_comment_url":"https://api.github.com/repos/svmastersamurai/osquery/issues/comments{/number}","contents_url":"https://api.github.com/repos/svmastersamurai/osquery/contents/{+path}","compare_url":"https://api.github.com/repos/svmastersamurai/osquery/compare/{base}...{head}","merges_url":"https://api.github.com/repos/svmastersamurai/osquery/merges","archive_url":"https://api.github.com/repos/svmastersamurai/osquery/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/svmastersamurai/osquery/downloads","issues_url":"https://api.github.com/repos/svmastersamurai/osquery/issues{/number}","pulls_url":"https://api.github.com/repos/svmastersamurai/osquery/pulls{/number}","milestones_url":"https://api.github.com/repos/svmastersamurai/osquery/milestones{/number}","notifications_url":"https://api.github.com/repos/svmastersamurai/osquery/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/svmastersamurai/osquery/labels{/name}","releases_url":"https://api.github.com/repos/svmastersamurai/osquery/releases{/id}","deployments_url":"https://api.github.com/repos/svmastersamurai/osquery/deployments","created_at":"2016-12-03T04:43:35Z","updated_at":"2016-12-03T04:43:38Z","pushed_at":"2016-12-28T02:28:58Z","git_url":"git://github.com/svmastersamurai/osquery.git","ssh_url":"git@github.com:svmastersamurai/osquery.git","clone_url":"https://github.com/svmastersamurai/osquery.git","svn_url":"https://github.com/svmastersamurai/osquery","homepage":"https://osquery.io","size":9726,"stargazers_count":0,"watchers_count":0,"language":"C++","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"facebook:master","ref":"master","sha":"383e07e5be0d4c36bc3780c680ba6d858ae2ea5e","user":{"login":"facebook","id":69631,"avatar_url":"https://avatars.githubusercontent.com/u/69631?v=3","gravatar_id":"","url":"https://api.github.com/users/facebook","html_url":"https://github.com/facebook","followers_url":"https://api.github.com/users/facebook/followers","following_url":"https://api.github.com/users/facebook/following{/other_user}","gists_url":"https://api.github.com/users/facebook/gists{/gist_id}","starred_url":"https://api.github.com/users/facebook/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/facebook/subscriptions","organizations_url":"https://api.github.com/users/facebook/orgs","repos_url":"https://api.github.com/users/facebook/repos","events_url":"https://api.github.com/users/facebook/events{/privacy}","received_events_url":"https://api.github.com/users/facebook/received_events","type":"Organization","site_admin":false},"repo":{"id":22394357,"name":"osquery","full_name":"facebook/osquery","owner":{"login":"facebook","id":69631,"avatar_url":"https://avatars.githubusercontent.com/u/69631?v=3","gravatar_id":"","url":"https://api.github.com/users/facebook","html_url":"https://github.com/facebook","followers_url":"https://api.github.com/users/facebook/followers","following_url":"https://api.github.com/users/facebook/following{/other_user}","gists_url":"https://api.github.com/users/facebook/gists{/gist_id}","starred_url":"https://api.github.com/users/facebook/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/facebook/subscriptions","organizations_url":"https://api.github.com/users/facebook/orgs","repos_url":"https://api.github.com/users/facebook/repos","events_url":"https://api.github.com/users/facebook/events{/privacy}","received_events_url":"https://api.github.com/users/facebook/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/facebook/osquery","description":"SQL powered operating system instrumentation, monitoring, and analytics.","fork":false,"url":"https://api.github.com/repos/facebook/osquery","forks_url":"https://api.github.com/repos/facebook/osquery/forks","keys_url":"https://api.github.com/repos/facebook/osquery/keys{/key_id}","collaborators_url":"https://api.github.com/repos/facebook/osquery/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/facebook/osquery/teams","hooks_url":"https://api.github.com/repos/facebook/osquery/hooks","issue_events_url":"https://api.github.com/repos/facebook/osquery/issues/events{/number}","events_url":"https://api.github.com/repos/facebook/osquery/events","assignees_url":"https://api.github.com/repos/facebook/osquery/assignees{/user}","branches_url":"https://api.github.com/repos/facebook/osquery/branches{/branch}","tags_url":"https://api.github.com/repos/facebook/osquery/tags","blobs_url":"https://api.github.com/repos/facebook/osquery/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/facebook/osquery/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/facebook/osquery/git/refs{/sha}","trees_url":"https://api.github.com/repos/facebook/osquery/git/trees{/sha}","statuses_url":"https://api.github.com/repos/facebook/osquery/statuses/{sha}","languages_url":"https://api.github.com/repos/facebook/osquery/languages","stargazers_url":"https://api.github.com/repos/facebook/osquery/stargazers","contributors_url":"https://api.github.com/repos/facebook/osquery/contributors","subscribers_url":"https://api.github.com/repos/facebook/osquery/subscribers","subscription_url":"https://api.github.com/repos/facebook/osquery/subscription","commits_url":"https://api.github.com/repos/facebook/osquery/commits{/sha}","git_commits_url":"https://api.github.com/repos/facebook/osquery/git/commits{/sha}","comments_url":"https://api.github.com/repos/facebook/osquery/comments{/number}","issue_comment_url":"https://api.github.com/repos/facebook/osquery/issues/comments{/number}","contents_url":"https://api.github.com/repos/facebook/osquery/contents/{+path}","compare_url":"https://api.github.com/repos/facebook/osquery/compare/{base}...{head}","merges_url":"https://api.github.com/repos/facebook/osquery/merges","archive_url":"https://api.github.com/repos/facebook/osquery/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/facebook/osquery/downloads","issues_url":"https://api.github.com/repos/facebook/osquery/issues{/number}","pulls_url":"https://api.github.com/repos/facebook/osquery/pulls{/number}","milestones_url":"https://api.github.com/repos/facebook/osquery/milestones{/number}","notifications_url":"https://api.github.com/repos/facebook/osquery/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/facebook/osquery/labels{/name}","releases_url":"https://api.github.com/repos/facebook/osquery/releases{/id}","deployments_url":"https://api.github.com/repos/facebook/osquery/deployments","created_at":"2014-07-29T20:27:33Z","updated_at":"2016-12-28T20:06:31Z","pushed_at":"2016-12-28T17:26:24Z","git_url":"git://github.com/facebook/osquery.git","ssh_url":"git@github.com:facebook/osquery.git","clone_url":"https://github.com/facebook/osquery.git","svn_url":"https://github.com/facebook/osquery","homepage":"https://osquery.io","size":9716,"stargazers_count":7617,"watchers_count":7617,"language":"C++","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":886,"mirror_url":null,"open_issues_count":90,"forks":886,"open_issues":90,"watchers":7617,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/facebook/osquery/pulls/2839"},"html":{"href":"https://github.com/facebook/osquery/pull/2839"},"issue":{"href":"https://api.github.com/repos/facebook/osquery/issues/2839"},"comments":{"href":"https://api.github.com/repos/facebook/osquery/issues/2839/comments"},"review_comments":{"href":"https://api.github.com/repos/facebook/osquery/pulls/2839/comments"},"review_comment":{"href":"https://api.github.com/repos/facebook/osquery/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/facebook/osquery/pulls/2839/commits"},"statuses":{"href":"https://api.github.com/repos/facebook/osquery/statuses/a4dd03284319c65edf8455933806ca7aa7a9d7ab"}}}}
{"actor":{"display_login":"PoppySeedPlehzr"}}