Finding a host via its MAC

Just something quick, when you have to find the IP address of a host that is tacking its MAC address via DHCP – and you don’t have access to the DHCP server in charge and its logs about given leases. There are a couple of ways doing so, and mine is likely not the most ideal one…

A couple of tools exist to scan your local network completely using nmap or arp-scan:

# nmap  -sn xxx.xxx.xxx.xxx/24

# arp-scan --interface=em0 -l

If you know the MAC address and don’t want to blast the whole network with broadcasts (although for a short time) you can use arping:

# arping 00:00:00:00:00:00

For sure the IP in use has to be within the same IP subnet since it sends broadcasts to the network in the IP level which ARP resolves to a given MAC address. Since ARP is not use for routed traffic this won’t help you if that machine is in another subnet.

Leave a Reply

December 3, 2014

Posted In: Uncategorized

Tags: , ,

Leave a Comment