Hey, Scripting Guy! How can I determine the local area connection that’s associated with a particular IP address?

— SH

Hey, SH. Believe it or not, this is a fairly complicated procedure, and for two reasons. To begin with, we have to use two separate WMI classes – Win32_NetworkAdapter and Win32_NetworkAdapterConfiguration – in order to retrieve the information we need. That’s because network connection information is stored in one class (Win32_NetworkAdapter) and IP addresses are stored in another (Win32_NetworkAdapterConfiguration). On top of that, Windows considers all sorts of things – wired connections, wireless connections, VPN connections, FireWire ports, you name it – to be network connections. This means we have quite a bit of data to wade through before we can link a specific network connection to a specific ID.

Oh, yeah: and IP addresses are stored as arrays. This isn’t a major problem, but it does represent one more hurdle we have to overcome.

OK, now that you all feel sufficiently sorry for us (“Oh, those poor Scripting Guys; they have to work so hard to try and answer our questions!”) let’s show you a script that reports back the network connection associated with the IP address 192.59.244.247:

strComputer = “.”
strTargetAddress = “192.59.244.247”

Set objWMIService = GetObject(“winmgmts:\\” & strComputer & “\root\cimv2”)
Set colItems = objWMIService.ExecQuery _
    (“Select * From Win32_NetworkAdapterConfiguration Where IPEnabled = True”)
For Each objItem in colItems
    arrIPAddresses = objItem.IPAddress
    For Each strAddress in arrIPAddresses
        If strAddress = strTargetAddress Then
            strMACAddress = objItem.MacAddress
        End If
    Next
Next
Set colItems = objWMIService.ExecQuery _
    (“Select * From Win32_NetworkAdapter Where MACAddress = ‘” & strMACAddress & “‘”)
For Each objItem in colItems
    If Not IsNull(objItem.NetConnectionID) Then
        Wscript.Echo objItem.NetConnectionID
    End If
Next

After assigning values to the variables strComputer and strTargetAddress (which represent the computer we’re working with and the target IP address, respectively) we bind to the WMI service and then use the ExecQuery method to select all instances of the Win32_NetworkAdapterConfiguration class where the IPEnabled property is equal to True. This returns only TCP/IP-enabled network adapters, and weeds out things like FireWire connections.

We then set up a For Each loop to cycle through the returned collection. Inside that For Each loop we assign the value of the IPAddress property of our first network adapter to an array variable named arrIPAddresses. (Don’t be fooled by the named IPAddress; this property can contain more than one IP address, which is why we need to use an array to get at the values.) We then set up a second For Each loop to loop through the array of IP addresses. For each address we check to see if the value matches our target IP address (192.59.244.247). If it does, we assign the value of the MACAddress property to a variable named strMACAddress. We continue this process until we’ve checked all the IP addresses for all the network adapters.

When we exit the loop we will know the MAC address of the network adapter associated with our target IP address. Believe it or not, that’s the key to unlocking this mystery. Why? Because the MACAddress property is found in both of our WMI classes. As soon as we know the MAC address associated with the IP address 192.59.244.247 all we have to do find this same MAC address somewhere in the Win32_NetworkAdapter class. When we do that, we can then determine the name of the network connection associated with that IP address.

And that’s exactly what we do with this second WMI query, one that retrieves all instances of the Win32_NetworkAdapter class where the MACAddress is equal to the MAC address associated with our IP address:

Set colItems = objWMIService.ExecQuery _
    (“Select * From Win32_NetworkAdapter Where MACAddress = ‘” & strMACAddress & “‘”)

Relax; we’re almost done here. We now loop through the returned collection, eliminating any instances where the NetConnectionID property is null. Eventually we’ll get back a message like this one:

OK, sure, it doesn’t look like much. But this just happens to be the name of the network connection associated with the IP address 192.59.244.247. And that ought to be worth something, right?

Incidentally, you can find some additional information about associating network connections and network adapters in the whitepaper Automating TCP/IP Networking on Clients. Click the link and then search for Associating the Network Connections Name with MAC and IP Addresses Using Two Classes.