Re: Determine IP Adrress from MAC Address

["Karl E. Jorgensen" <karl@jorgensen.org.uk>]

Hi

On Tue, Feb 18, 2014 at 12:36:08AM +0600, Muntasim-Ul-Haque wrote:
> Hi,
> How can I determine the IP address if I already have the MAC address
> or Hardware Address? What is the most convenient way?

I know of no "easy" way - but there *are* two ways I can think
of. Both assume that you have access to another box on the same
network.

(1) Passively listen on the network and wait for the MAC address to
"speak". Since you are most likely connected via a switch, you will
only see broadcast/multicast traffic (unless the target MAC address
talks directly to you).

Something like:

# tcpdump -i eth0 -n -l -c 1 ether host ${mac_address} and arp

Then you can see ARP requests issued by the mac address in question,
in the style of:

19:03:02.281737 ARP, Request who-has 192.168.0.130 (ff:ff:ff:ff:ff:ff) tell 192.168.0.3, length 28

which tells us which IP address ${mac_address} is associated with
(192.168.0.3 in my example)


(2) Another way is to actively scan the whole network, and check your arp cache
afterwards, e.g.:

# nmap -sP 192.168.0.0/24

(lots of nmap output - can be ignored)

# arp -an

Hope this helps

-- 
Karl E. Jorgensen