12

I would like to look up a MAC address on my ethernet and find the IP of that machine. What command should I issue using which app?

edit: i've tried: fping -g 195.88.88.0/24 | arp -a | grep 4C:12:10:11:35:B4 but that does not work (i checked with my own MAC whether it can find or not)

sterz
  • 784

3 Answers3

13

Download and install arp-scan - it will return all MAC addresses it can find and their reported IP addresses. Many distros have an arp-scan package in their repositories.

For example, to scan network 192.168.1.0:

arp-scan 192.168.1.0/24
n611x007
  • 6,566
  • 15
  • 67
  • 91
Linker3000
  • 28,240
1

As far as I am aware, nmap can't do this. You may be able to do this by looking at the ARP transactions with tcpdump, or on Windows, try using arp -a (but only if you've previously communicated with it).

0

The MAC address may not have an associated IP address, (or its IP address might not be compatible with your hosts network/mask). To get all hosts that can respond, to answer a ping, use 255.255.255.255.

As others have suggested, use tcpdump -env to look for ARP and MAC addresses. If you suspect there might be an IP misconfiguration, you can set your ip/netmask to some large netmask (195.88.88. netmask 128.0.0.0, which will likely take you offline.

Ping 255.255.255.255 and see if you get an address resolution. (This will cover networks from 128 - 255; set your ip to 10.10.10.10/128.0.0.0 to get the other half of the possible IPv4 addresses.