How to find the ip of a mac-address

[Dan Track]

Hi

I've got the mac-address of desktop. But I don't know it's IP, are
there any tools that I can use to find this IP.

Thanks
Dan

[Chasecreek Systemhouse]

On 3/13/06, Dan Track  wrote:
> Hi
>
> I've got the mac-address of desktop. But I don't know it's IP, are
> there any tools that I can use to find this IP.

Is this a Windows question?  ipconfig /all

Is this a Linux question?  ifconfig eth0
or ifconfig -a

If you are on Windows get Cain -- it scans MACs and translates to
IP/Hosts; if you are on Linux then try system-config-network

HTH
--
WC (Bill) Jones -- http://youve-reached-the.endoftheinternet.org/

[Dan Track]

On 3/13/06, Chasecreek Systemhouse  wrote:
> On 3/13/06, Dan Track  wrote:
> > Hi
> >
> > I've got the mac-address of desktop. But I don't know it's IP, are
> > there any tools that I can use to find this IP.
>
> Is this a Windows question?  ipconfig /all
>
> Is this a Linux question?  ifconfig eth0
> or ifconfig -a
>
> If you are on Windows get Cain -- it scans MACs and translates to
> IP/Hosts; if you are on Linux then try system-config-network
>
> HTH

Hi

Thanks for the reply. But its not what I needed. Basically I don't
know anything about this desktop, I don't even have console access.
The only way I can find it is by the IP, but I only know the
mac-address, where can I go from here. BTW it's a linux desktop.

Thanks
Dan

[Andy Green]

Dan Track wrote:
> Thanks for the reply. But its not what I needed. Basically I don't
> know anything about this desktop, I don't even have console access.
> The only way I can find it is by the IP, but I only know the
> mac-address, where can I go from here. BTW it's a linux desktop.

If your box has touched this box recently, try

arp

To increase the chances of interaction between your boxes (and everyone
elses on your segment)

ping -b <broadcast ads>

eg

ping -b 192.168.0.255

then do the arp

-Andy

[Mikkel]

Andy Green wrote:
> Dan Track wrote:
> > Thanks for the reply. But its not what I needed. Basically I don't
> > know anything about this desktop, I don't even have console access.
> > The only way I can find it is by the IP, but I only know the
> > mac-address, where can I go from here. BTW it's a linux desktop.
>
> If your box has touched this box recently, try
>
> arp
>
> To increase the chances of interaction between your boxes (and everyone
> elses on your segment)
>
> ping -b <broadcast ads>
>
> eg
>
> ping -b 192.168.0.255
>
> then do the arp
>
> -Andy

One refinement I like when doing this is to use:

ping -c1 -b 192.168.0.255
/sbin/arp -n

That way, you are only sending out one ping. But this will fail if
the machine you are looking for does not respond to pings, if it
is on another subnet, or on the other side of a gateway device.
(Any route to another machine that goes through a gateway will show
the MAC address of the gateway.)

Mikkel

[Leonard Isham]

On 3/13/06, Dan Track  wrote:
> On 3/13/06, Chasecreek Systemhouse  wrote:
> > On 3/13/06, Dan Track  wrote:
> > > Hi
> > >
> > > I've got the mac-address of desktop. But I don't know it's IP, are
> > > there any tools that I can use to find this IP.
> >
> > Is this a Windows question?  ipconfig /all
> >
> > Is this a Linux question?  ifconfig eth0
> > or ifconfig -a
> >
> > If you are on Windows get Cain -- it scans MACs and translates to
> > IP/Hosts; if you are on Linux then try system-config-network
> >
> > HTH
>
> Hi
>
> Thanks for the reply. But its not what I needed. Basically I don't
> know anything about this desktop, I don't even have console access.
> The only way I can find it is by the IP, but I only know the
> mac-address, where can I go from here. BTW it's a linux desktop.

Ping the subnet's broadcast address, and assuming the system replies
you can then use:

arp -a | grep

Adding the MAC address in the proper format to the grep command.

--
Leonard Isham, CISSP
Ostendo non ostento.

[Michaël Hooreman]

[e-mail] <> scribbled on lundi 13 mars 2006 13:55:
> On 3/13/06, Chasecreek Systemhouse
>  wrote:
> The only way I can find it is by the IP, but
> I only know the mac-address, where can I go from here. BTW it's a
> linux desktop.

If my understanding of your problem is good:

For me, you can't get the IP address from the MAC address: the MAC is
not related to the IP by any way.

An IP packet has the MAC of the origin network device. But you can
change the IP address of a device, so I think that your question doesn't
have sense.

---
Michaël Hooreman
Keyware Transaction and Processing
Rue Laid Burniad, 4
1348 - Louvain-La-Neuve
Belgium
Tel : [phone]
Fax : [phone]
[e-mail]

[Chasecreek Systemhouse]

On 3/13/06, Michaël Hooreman  wrote:
> > The only way I can find it is by the IP, but
> > I only know the mac-address, where can I go from here. BTW it's a
> > linux desktop.
>
> If my understanding of your problem is good:
>
> For me, you can't get the IP address from the MAC address: the MAC is
> not related to the IP by any way.
>
> An IP packet has the MAC of the origin network device. But you can
> change the IP address of a device, so I think that your question doesn't
> have sense.

You can reasonably hope that the MAC-to-IP binding has not staled;
therefore you can scan a live net and see the MAC to IP to Hostname on
it.

BTW - You can also spoof the MAC address of a card but all this is a
different story.
--
WC (Bill) Jones -- http://youve-reached-the.endoftheinternet.org/

[Tim]

On Mon, 2006-03-13 at 14:04 +0100, Michaël Hooreman wrote:
> For me, you can't get the IP address from the MAC address: the MAC is
> not related to the IP by any way.

If your PC has had communications with the other, it will have
remembered both details and correlated them together.  The arp command's
output will show you that.  True that they're only related by
coincidence, but that's enough.

[Dan Track]

On 3/13/06, Tim  wrote:
> On Mon, 2006-03-13 at 14:04 +0100, Michaël Hooreman wrote:
> > For me, you can't get the IP address from the MAC address: the MAC is
> > not related to the IP by any way.
>
> If your PC has had communications with the other, it will have
> remembered both details and correlated them together.  The arp command's
> output will show you that.  True that they're only related by
> coincidence, but that's enough.

Thanks to all who replied. I used what you suggested, i.e broadcast
and then match with arp.
It worked.

Thanks
Dan

[Scot L. Harris]

On Mon, 2006-03-13 at 12:55 +0000, Dan Track wrote:
> On 3/13/06, Chasecreek Systemhouse  wrote:
> > On 3/13/06, Dan Track  wrote:
> > > Hi
> > >
> > > I've got the mac-address of desktop. But I don't know it's IP, are
> > > there any tools that I can use to find this IP.
> >
> > Is this a Windows question?  ipconfig /all
> >
> > Is this a Linux question?  ifconfig eth0
> > or ifconfig -a
> >
> > If you are on Windows get Cain -- it scans MACs and translates to
> > IP/Hosts; if you are on Linux then try system-config-network
> >
> > HTH
>
> Hi
>
> Thanks for the reply. But its not what I needed. Basically I don't
> know anything about this desktop, I don't even have console access.
> The only way I can find it is by the IP, but I only know the
> mac-address, where can I go from here. BTW it's a linux desktop.

If you are on a different system you might try looking at the arp table.

/sbin/arp

Will list IP/MAC addresses of systems your machine has talked to
recently.

[Michael H. Warfield]

On Mon, 2006-03-13 at 12:55 +0000, Dan Track wrote:
> On 3/13/06, Chasecreek Systemhouse  wrote:
> > On 3/13/06, Dan Track  wrote:
> > > Hi
> > >
> > > I've got the mac-address of desktop. But I don't know it's IP, are
> > > there any tools that I can use to find this IP.
> >
> > Is this a Windows question?  ipconfig /all
> >
> > Is this a Linux question?  ifconfig eth0
> > or ifconfig -a
> >
> > If you are on Windows get Cain -- it scans MACs and translates to
> > IP/Hosts; if you are on Linux then try system-config-network
> >
> > HTH
> Hi
> Thanks for the reply. But its not what I needed. Basically I don't
> know anything about this desktop, I don't even have console access.
> The only way I can find it is by the IP, but I only know the
> mac-address, where can I go from here. BTW it's a linux desktop.

Assuming you are on the same subnet as the box in question...  Run an
nmap ping sweep on the subnet to find all the machines and then use "arp
-a" to dump your arp table and look for that max address.  Pinging the
broadcast address doesn't always work, depending on the box and
filtering rules.  Pinging the broadcast address might work, though, and
might be worth trying first.  If the broadcast ping doesn't work, then
fall back to nmap.

Alternatively, if it's a dynamic address, you might check the
dhcpserver.

Mike
> Thanks
> Dan

[Daniel Challen]

On Mon, 2006-03-13 at 12:40 +0000, Dan Track wrote:
> Hi
>
> I've got the mac-address of desktop. But I don't know it's IP, are
> there any tools that I can use to find this IP.

Presuming you're on the same LAN, and the desktop is not running Windows
(which does not respond to the broadcast address):
  ping -b 192.168.0.255      (substitute with your broadcast address)
  /sbin/arp -a | grep 00:10:00:FF:FF:FF		(substitute with the MAC
address of the desktop)

Failing that, you can watch network traffic and hope the desktop machine
generates some traffic:
  tcpdump -v ether host 00:10:00:FF:FF:FF

- Dan

This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. This communication may be legally privileged.  If you are not the intended receipient, please be advised that you have received this email in error and that any use, dissemination, forwarding, printing or copying of this email is strictly prohibited. If you have received this email in error, please notify the OCSL switchboard on [phone]

[John Summerfield]

Daniel Challen wrote:
> On Mon, 2006-03-13 at 12:40 +0000, Dan Track wrote:
> > Hi
> >
> > I've got the mac-address of desktop. But I don't know it's IP, are
> > there any tools that I can use to find this IP.
>
> Presuming you're on the same LAN, and the desktop is not running Windows
> (which does not respond to the broadcast address):

Linux can be configured to not repond to broadcast pings, and windows 
can be configured to respond to the,;-\
> ping -b 192.168.0.255      (substitute with your broadcast address)
>   /sbin/arp -a | grep 00:10:00:FF:FF:FF		(substitute with the MAC
> address of the desktop)
>
> Failing that, you can watch network traffic and hope the desktop machine
> generates some traffic:
>   tcpdump -v ether host 00:10:00:FF:FF:FF

If you're using DHCP, then check the DHCP server's logs.

You can also use a shell script (or a small series of commands) to ping 
all likely addresses (google should find some sample bash scripts for 
you) and see what arp says.

nmap also has the ability to ping a range of IP addresses, and scanning 
your local LAN for http servers would be quick (but less educational 
than the scripting approach) and create the needed ARP entries.

[Dan Track]

On 4/4/06, John Summerfield  wrote:
> Daniel Challen wrote:
> > On Mon, 2006-03-13 at 12:40 +0000, Dan Track wrote:
> > > Hi
> > >
> > > I've got the mac-address of desktop. But I don't know it's IP, are
> > > there any tools that I can use to find this IP.
> >
> > Presuming you're on the same LAN, and the desktop is not running Windows
> > (which does not respond to the broadcast address):
>
> Linux can be configured to not repond to broadcast pings, and windows
> can be configured to respond to the,;-\
> > ping -b 192.168.0.255      (substitute with your broadcast address)
> >   /sbin/arp -a | grep 00:10:00:FF:FF:FF               (substitute with the MAC
> > address of the desktop)
> >
> > Failing that, you can watch network traffic and hope the desktop machine
> > generates some traffic:
> >   tcpdump -v ether host 00:10:00:FF:FF:FF
>
> If you're using DHCP, then check the DHCP server's logs.
>
> You can also use a shell script (or a small series of commands) to ping
> all likely addresses (google should find some sample bash scripts for
> you) and see what arp says.
>
> nmap also has the ability to ping a range of IP addresses, and scanning
> your local LAN for http servers would be quick (but less educational
> than the scripting approach) and create the needed ARP entries.
>
> --
>
> Cheers
> John

Hi All

Thanks everyone for all your replies.

It's been a real eye opener. I managed to find the ip using the
suggested techniques.

Thanks again
Dan