Linux find ip by mac

Узнать IP по MAC

Очень простой сабж. Есть mac, как это сделать на простой клиентской машине в локальной сети? Если есть способ — подойдёт ли и для internet?

Re: Узнать IP по MAC

Можешь сделать броадкаст пинг а потом посмотреть таблицу arp

ping 192.168.255.255
arp -a

Re: Узнать IP по MAC

не катит. но идея неплоха, спасибо.

Re: Узнать IP по MAC

Re: Узнать IP по MAC

огромное спасибо, но это не вариант. те в моём случае (я совершенно случайно нашёл этот ип) пинг не проходит (ответа не будет). есть ли ещё какие принципиально новые способы?

(я нашёл ип, так как разбирался с мультикастом и у нас на 1-м ипе висит туева хуча этих «ретрансляторов» — то есть свезло). вопрос ребром — может ли сервер сам выдать каким-то образом arp таблицу сети/сегмента?

Re: Узнать IP по MAC

Для этого nmap есть. И нет никакой разницы, отвечает хост на пинг или нет, ибо на arp-запрос он все равно ответит.

Узнать IP по MAC — задача неоднозначная, так как IP на одном МАС может быть много. Тут только сканить, а затем arp -an. И никакой пинг по широковещательным адресам Вам не поможет.

Посмотрите еще на arpwatch

И еще. Я дико извиняюсь, но понимаете ли Вы, что это все относится к одному физическому сегменту, в котором и находится Ваш хост.

Re: Узнать IP по MAC

>Для этого nmap есть

как мне указать nmap-y цель по MAC адресу?

>Я дико извиняюсь, но понимаете ли Вы, что это все относится к одному физическому сегменту, в котором и находится Ваш хост

даже если мы снифаем трафф в promisc.

это arpwatch в пределах сегмента, что очевидно впрочем. нужен какой-то аналог ping-а, но по MAC адресу.

Re: Узнать IP по MAC

>>Я дико извиняюсь, но понимаете ли Вы, что это все относится к одному физическому сегменту, в котором и находится Ваш хост

>даже если мы снифаем трафф в promisc.

‘s/физическому сегменту/широковещательному домену/’

Даже если 🙂 promisc ничего не меняет. Все arp-запросы и прочий не IP-трафик через маршрутизатор не ходит.

Re: Узнать IP по MAC

Re: Узнать IP по MAC

также есть arping
DESCRIPTION
The arping utility sends ARP and/or ICMP requests to the specified host and displays the replies. The host may
be specified by its hostname, its IP address, or its MAC address.

но опять таки в пределах одного сегмента .

Re: Узнать IP по MAC

>j262 ** (*) (20.07.2007 10:15:08)

arping не работает с маком, ему в destination нужен ip и за маршрутизатор его не пустят.

Резюме — дело дрянь.

Re: Узнать IP по MAC

почему не работает
!arpi
arping 00:03:6B:EF:77:E0
ARPING 00:03:6B:EF:77:E0
60 bytes from 172.16.0.8 (00:03:6b:ef:77:e0): icmp_seq=0 time=1.143 msec
60 bytes from 172.16.0.8 (00:03:6b:ef:77:e0): icmp_seq=1 time=1.080 msec
60 bytes from 172.16.0.8 (00:03:6b:ef:77:e0): icmp_seq=2 time=1.069 msec

ну да , за рутер не пустит .

Re: Узнать IP по MAC

>и за маршрутизатор его не пустят.

боюсь тебе поможет только изучение основ ethernet сетей

проще говоря, если ты не в одном _физическом_ сегменте, то мак-адрес тебе не поможет, да его у машины может и не быть (не ethernetом единым)

Re: Узнать IP по MAC

если целевая машина находится за сегментом, то это не её мак, а мак маршрутизатора;)

Re: Узнать IP по MAC

Тоесть маршрутизатор ставит свой мак при пересылке пакетов.

Re: Узнать IP по MAC

кстати, FYI, некоторые провайдеры сильно напрягаются и жалуются ФСБшникам если находят сетевушку в promisc режиме у клиентов.. а этот режим в принципе обнаружим. на просторах инета пару лет назад находил простенький сишный код для этого.

Re: Узнать IP по MAC

Обнаружимо, если реализация хреновая. Вроде, это давно исправили. Хотя, может и нет.

Re: Узнать IP по MAC

Горе человек, иди учи как устроены сетевой и канальный уровни; плюс маршрутизаци в IP сетях.

Не пудри мозги людям.

Re: Узнать IP по MAC

имхо можно и так:

nmap -sP 192.168.72-79.1-254 | grep 40:04:61:9d:a7:ac

Источник

Thread: Find device on local network by MAC Adress

Thread Tools

Display

Find device on local network by MAC Adress

How do I find the IP address on a local wired network by mac address with Linux. It seems like Linux would have this command, because it is easy to do in the command in Windows: arp -s 10.2.2.249 01-00-5e-7f-ff-fa

I’ve tried «arping», but I can’t figure out syntax that works or find an example online.

Re: Find device on local network by MAC Adress

I don’t know if this is a ‘good’ way to to it, but ‘nmap -n’ appears to give the info you want — only if you run it as root though, e.g.

will list all the IPs + MACs on the 8-bit host space including 10.2.2.249 ( I’m assuming you don’t really want to scan the whole 24-bit 10.x.x.x/8 host space)

to grep out a single MAC

Re: Find device on local network by MAC Adress

I think some would be confused by the Windows command I posted. The command modifys the arp cache to assign a (bogus) IP to a MAC address of that device can be reached by my machine by that assigned IP. I really don’t like explaining why I do something because it often detracts from the question. In brief, I often need to find an embedded device on a large lan. I can then ssh to the arp assigned IP then find out the devices real IP. I want to use my own Ubuntu computer to do this and not have to hunt down and borrow a Windows computer every time. I’ve looked at the manual for ‘arp’ on linux and I don’t see how to do the same thing.

Re: Find device on local network by MAC Adress

Nope scanning won’t work with the 65000 addresses in the address space, and a few other issues with scanning. Last time I tried I set off the intrusion detection system and got in big trouble. Save your questions, nothing I can do about it, I’m not the net admin.

Last edited by bakegoodz; June 12th, 2012 at 02:59 PM .

Re: Find device on local network by MAC Adress

Try ‘arp -n’ or ‘arp -a’ to get IP addresses instead of machine names.
This command will give you the real IP address,
Assuming, of course, that the machine is already in your arp cache.

‘arp -s’ should create a new entry, just like your current method, and with identical syntax.

Last edited by Cheesehead; June 12th, 2012 at 03:17 PM .

Re: Find device on local network by MAC Adress

Nope not it arp cache because I haven’t connected to it yet.

Re: Find device on local network by MAC Adress

arp -s works on linux.
You need admin rights, so use sudo.
Use colons, not hyphens in the hardware address. e.g.
sudo arp -s 10.2.2.249 01:00:5e:7f:ff:fa

but I don’t see how that enables you to discover its real IP address, on either linux or windows.

Re: Find device on local network by MAC Adress

arp -s works on linux.
You need admin rights, so use sudo.
Use colons, not hyphens in the hardware address. e.g.
sudo arp -s 10.2.2.249 01:00:5e:7f:ff:fa

but I don’t see how that enables you to discover its real IP address, on either linux or windows.

Once you set a fake IP in your arp cache you can connect to that device using the fake IP and find out from the device itself what its IP is. I did that to access a print server when I did not know its IP nor how to have it print out its configuration. Once I connected to it I discovered that someone had accidentally manually set it to a 192.186. IP instead of 192.168. (after correcting its IP it worked). It was an old used print server that our MIS dept thought was broken.

Also comes in handy for accessing WAPs and wireless bridges when you forget what IP address you set them to.

Last edited by efflandt; June 13th, 2012 at 05:19 AM .

Источник

How to get an IP address from MAC Address in Linux.

Anyone know of a way to get an IP address of a device if I have the MAC adderss.

Reason being is I’m writing a script to ssh into a device and chagne the default IP address to use DHCP. so I can’t really know what the DHCP address will be. but I can get the MAC address when I ssh with the default IP.

I’ve read the RARP might be able to do this, however, my kernel version does not support RARP (so it says) and from the help I can’t figure out how to get this to work.

Usage: rarp -a list entries in cache.
rarp -d delete entry from cache.
rarp [ ] -s add entry to cache.
rarp -f add entries from /etc/ethers.
rarp -V display program version.

Anyone have another way to accomplish this?

1. check the lease table on the DHCP server for the MAC address.

2. Some managed switches can also show you which IPs are on which port, so you’d just need to look for the MAC in the arp cache/forwarding table.

3. Ping sweep the subnet, then parse your arp cache for the MAC

When you say Ping sweep the subnet, are you referring to broadcast pinging? ie: ping -b 192.168.20.255 to find all the devices on subnet 20?

Broadcast ping does not seem to use arp requests and therefore does not update the arp table.

My DHCP server is running on my router. I can see the DHCP lease table through the web GUI to my router (and possibly some CLI commands to the router) but I would like to keep my scripts generic enough that they would work on other networks with different DHCP servers. Could there be a terminal command to display this lease table in Linux from my router?

I was thinking maybe using Dynamic DNS and that way I could simply just use the host name of my device whether it has a static IP or using DHCP? But to do this I believe I would need to setup a server system to act as the DHCP and DNS server?

I appreciate your ideas.

If your linux box already recently seen traffic from that device (say, mac is 00:07:E9:62:8F:F3), it will have its mac/ip in the arp cache. Then its a simple:

$ /usr/sbin/arp -n | grep 8F:F3 | awk ‘‘
10.5.60.10

If not, you can try pinging every device on the network (ping -b
) which will fill in your ARP table.

Originally posted by Mako22:
Hey Frennzy,

When you say Ping sweep the subnet, are you referring to broadcast pinging? ie: ping -b 192.168.20.255 to find all the devices on subnet 20?

Broadcast ping does not seem to use arp requests and therefore does not update the arp table.

My DHCP server is running on my router. I can see the DHCP lease table through the web GUI to my router (and possibly some CLI commands to the router) but I would like to keep my scripts generic enough that they would work on other networks with different DHCP servers. Could there be a terminal command to display this lease table in Linux from my router?

I was thinking maybe using Dynamic DNS and that way I could simply just use the host name of my device whether it has a static IP or using DHCP? But to do this I believe I would need to setup a server system to act as the DHCP and DNS server?

I appreciate your ideas.

no, I’m referring to ping sweeping, not pinging a broadcast addres. that is, ping each address in your subnet, incrementally.

There are numerous tools that will do this for you.

Fint, ya see there is where the problem lies. there was recently traffic, so it is in my arp table, but then I change the IP to use DHCP instead of a static address. so the «new» IP is not in the arp table, but I do have the MAC address. Incidentally, does anyone know if there is an arp parameter to delete the entire table in Linux. like in Windows «arp -d»? I will need to do this (I assume) in order to no longer have the «old» IP associated to the MAC address (zombie entry) before parsing for the «new» IP?

Broadcast pinging does not seem to send arp requests so does not populate the arp table.

Frennzy, ok I think I got it, thanks. Pinging does populate the arp table, so if I ping sweep, I would be pinging every address, whether there is a device associated or not. After this I should have an arp table to parse through looking for my MAC address.

Now to implement this and see if I can egt this to work from a script (BTW: the script is python using pexpect)

Источник

How to find IP and MAC Address by command line in Linux

ip command lets you find the IP address and MAC address of a network connection.

A nother day, another command line tutorial. Today, let’s talk about a vital networking command in Linux, ip. This command is handy to fish out network parameters of the Linux computer.

It works on all Linux distributions including Ubuntu, Arch Linux, Debian, Fedora, etc..

ip command

ip command is a highly powerful command that replaced the now-depreciated ifconfig command which was a part of the net-tools package. The general syntax of the command is as follows:

Where xx must be replaced with one of the following to get the desired output.

-V to display ip utility version

-s to display more information about the command

ip command usage in Ubuntu 17.10

Finding the IP address of the Linux System

Launch ‘Terminal’ and enter the following command to list all the IP address.

ip route list command usage in Ubuntu 17.10

It should display all available IP address including device names. If you are only interested in the default IP address that connects to the internet, use a grep parameter to list that one.

Alternatively, you can also use device name in particular too, but you should know the names of network devices for that. Use ip addr show command:

Typically, eth0 is for Ethernet connection, and wlp2s0 for Wireless connection.

For example, use eth0 :

Finding the MAC Address of the Linux System

MAC address is another critical parameter of a network device, including your PC’s hardware or a server. Every PC’s network device should have a unique MAC address.

Launch Terminal and enter the ip link command:

The ip utility should list several parameters of the device. For each device, two lines should summarize the link state and characteristics. The first line summarizes the current name of the device, the flags set on the device, the maximum transmission unit (MTU) and so on.

The second line should always indicate the type of link layer in use and the current hardware address (MAC Address). In the above example, XXXXXXXXXXXX and YYYYYYYYYYY are the MAC Address of the two LAN connections in use.

Источник