How to find IP address of a machine if I know their MAC Address
 

Hi,

I recently picked up an NCD 88K terminal server, and was wondering how I can figure out the IP address o fhe macine. The MAC address is printed on teh bottom of the machine. Is there any way I can scan my local network to try and find the IP address that corresponds to the MAC address? It would be really nice to just hook up a monitor to the machine, but the female connector is a 26 pin ( 2 rows of 9, 1 row of 8) connector, which I've never seen before. Also when I do an arp -a the mac Address does not show up in my arp table.

thanks,

Jeff

from a console as root type:
This should give you the mac address and the ip assigned for all machines on the network.

Not sure if this is what you are looking for.

edit:

Actually, on second thought, I'm not certain that's true.
Perhaps it may be useful anyway. I'll check on that and if someone doen't correct me before that I'll correct myself. ;)

Yes, I right. It does give the mac address.

rarp is used to look up ip from mac

Of course, if you are like me and your kernel does not support rarp (because it was discontinued in kernel version 2.3), the poor man's lookup is to write a script that:
1) pings every address in the subnet.
2) does an arp -a
3) Finds the line with the correct MAC address and gets the IP address from that line.

Step 1 is really cheating, I guess, and it is probably not a good idea to flooding a large network with pings. However, for a smallish subnet (say with 253 addresses, x.y.z.1 - x.y.z.254), the liberal use of fping may be acceptable. This forces your computer to look up the MAC of each address it pings, and hopefully, it will store them for a few seconds while steps 2 & 3 extract the IP address.

It's easier to ping the subnet's broadcast address with "ping -b" then ^C and then look at "arp -a"

Rather than ^C it, just do 'ping -b -c1 192.168.1.0', but replace the IP with that of your network :)

set up a tcpdump with "ether host aa:bb:cc:dd:ee:ff" option
Huppert

i believe that arp -na will only give you the IP and mac of computers that are connected to "this" computer. I ran it on one of my boxes and it only showed 3: the router, and two computers which are connected with mounted shares. There are about 8 other computers on my network which didn't show up (and are all not connected)

Hook the unit up to a PC with a cross over ethernet cable. Then run Ethereal and see if you can collect any packets. Ethereal should display the IP address along with any other info.

collecting packets with ethereal
 

thanks for all the replies. I think connecting to iit with a crossover cable and collecting packets with ethereal is my only option because I think the device has a static IP and I have no idea what it might be. So if I set up my linux machine with an ip of 192.168.0.2 and connect to the terminal device with a crossover, will I still be able to pick up packets if the other device is on another subnet?(im at work, or i would just try it)

thanks,

Jeff

Maybe i am wrong, but how about "arping" ?

In my box it works ok:

root@box:~# arping -i eth1 00:E0:29:XX:YY:ZZ
ARPING 00:E0:29:XX:YY:ZZ
60 bytes from 192.168.0.AAA (00:e0:29:XX:YY:ZZ): icmp_seq=0 time=47.922 usec
60 bytes from 192.168.0.AAA (00:e0:29:XX:YY:ZZ): icmp_seq=1 time=44.823 usec
60 bytes from 192.168.0.AAA (00:e0:29:XX:YY:ZZ): icmp_seq=2 time=84.877 usec

What version of arping are you running? The version that comes with the current iputils package can only ping IP addresses.
/GSt

Problem found: There are two versions of arping. One by Alexey Kuznetsov that pings IP addresses and one by Thomas Habets that pings MAC addresses.
Why on earth give them the same name?