-   Linux - Networking (
-   -   How to find IP address of a machine if I know their MAC Address (

dysenteryduke 08-14-2005 05:41 PM

How to find IP address of a machine if I know their MAC Address

I recently picked up an NCD 88K terminal server, and was wondering how I can figure out the IP address o fhe macine. The MAC address is printed on teh bottom of the machine. Is there any way I can scan my local network to try and find the IP address that corresponds to the MAC address? It would be really nice to just hook up a monitor to the machine, but the female connector is a 26 pin ( 2 rows of 9, 1 row of 8) connector, which I've never seen before. Also when I do an arp -a the mac Address does not show up in my arp table.



Franklin 08-14-2005 06:23 PM

from a console as root type:

# arp -na
This should give you the mac address and the ip assigned for all machines on the network.

Not sure if this is what you are looking for.


Actually, on second thought, I'm not certain that's true.
Perhaps it may be useful anyway. I'll check on that and if someone doen't correct me before that I'll correct myself. ;)

Franklin 08-14-2005 06:41 PM

Yes, I right. It does give the mac address.

yvesg 08-14-2005 08:30 PM

rarp is used to look up ip from mac

carl.waldbieser 08-15-2005 12:08 AM

Of course, if you are like me and your kernel does not support rarp (because it was discontinued in kernel version 2.3), the poor man's lookup is to write a script that:
1) pings every address in the subnet.
2) does an arp -a
3) Finds the line with the correct MAC address and gets the IP address from that line.

Step 1 is really cheating, I guess, and it is probably not a good idea to flooding a large network with pings. However, for a smallish subnet (say with 253 addresses, x.y.z.1 - x.y.z.254), the liberal use of fping may be acceptable. This forces your computer to look up the MAC of each address it pings, and hopefully, it will store them for a few seconds while steps 2 & 3 extract the IP address.

primo 08-15-2005 02:08 AM

It's easier to ping the subnet's broadcast address with "ping -b" then ^C and then look at "arp -a"

Matir 08-15-2005 02:32 AM

Rather than ^C it, just do 'ping -b -c1', but replace the IP with that of your network :)

Andreas Huppert 08-15-2005 09:33 AM

set up a tcpdump with "ether host aa:bb:cc:dd:ee:ff" option

FliesLikeABrick 08-15-2005 09:48 AM

i believe that arp -na will only give you the IP and mac of computers that are connected to "this" computer. I ran it on one of my boxes and it only showed 3: the router, and two computers which are connected with mounted shares. There are about 8 other computers on my network which didn't show up (and are all not connected)

okmyx 08-15-2005 10:45 AM

Hook the unit up to a PC with a cross over ethernet cable. Then run Ethereal and see if you can collect any packets. Ethereal should display the IP address along with any other info.

dysenteryduke 08-15-2005 10:52 AM

collecting packets with ethereal
thanks for all the replies. I think connecting to iit with a crossover cable and collecting packets with ethereal is my only option because I think the device has a static IP and I have no idea what it might be. So if I set up my linux machine with an ip of and connect to the terminal device with a crossover, will I still be able to pick up packets if the other device is on another subnet?(im at work, or i would just try it)



imitheos 08-15-2005 11:01 AM

Maybe i am wrong, but how about "arping" ?

In my box it works ok:

root@box:~# arping -i eth1 00:E0:29:XX:YY:ZZ
60 bytes from 192.168.0.AAA (00:e0:29:XX:YY:ZZ): icmp_seq=0 time=47.922 usec
60 bytes from 192.168.0.AAA (00:e0:29:XX:YY:ZZ): icmp_seq=1 time=44.823 usec
60 bytes from 192.168.0.AAA (00:e0:29:XX:YY:ZZ): icmp_seq=2 time=84.877 usec

gustavst 09-12-2005 09:07 AM

What version of arping are you running? The version that comes with the current iputils package can only ping IP addresses.

gustavst 09-12-2005 11:21 AM

Problem found: There are two versions of arping. One by Alexey Kuznetsov that pings IP addresses and one by Thomas Habets that pings MAC addresses.
Why on earth give them the same name?

All times are GMT -5. The time now is 12:35 PM.