Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to write a bash script wherein I have to create a file which holds the details of IP Addresses of the hosts and their mapping with corresponding MAC Addresses.

Is there any possible way with which I can find out the MAC address of any (remote) host when IP address of the host is available?

share|improve this question
up vote 14 down vote accepted

If you just want to find out the MAC address of a given IP address you can use the command arp to look it up, once you've pinged the system 1 time.


$ ping skinner -c 1
PING skinner.bubba.net ( 56(84) bytes of data.
64 bytes from skinner.bubba.net ( icmp_seq=1 ttl=64 time=3.09 ms

--- skinner.bubba.net ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 3.097/3.097/3.097/0.000 ms

Now look up in the ARP table:

$ arp -a
skinner.bubba.net ( at 00:19:d1:e8:4c:95 [ether] on wlp3s0


If you want to sweep the entire LAN for MAC addresses you can use the command line tool fing to do so. It's typically not installed so you'll have to go download it and install it manually.

$ sudo fing

    fing example


share|improve this answer
I know this is an old answer, but do you have any insight as to how Fing is implemented? I am trying to learn about this layer of networking and the tools to monitor it. – akaphenom Mar 8 at 20:31
@akaphenom If you have new questions please them outright, comments aren't meant for that. – slm Mar 9 at 0:33

This is from my question and answer in askubuntu.

You can use the command

   sudo nmap -sP -PE -PA21,23,80,3389 192.168.1.*

nmap: Network exploration tool and security / port scanner. From the manual:

-sP (Skip port scan) . This option tells Nmap not to do a port scan after host discovery, and only print out the available hosts that responded to the scan. This is often known as a “ping scan”, but you can also request that traceroute and NSE host scripts be run. This is by default one step more intrusive than the list scan, and can often be used for the same purposes. It allows light reconnaissance of a target network without attracting much attention. Knowing how many hosts are up is more valuable to attackers than the list provided by list scan of every single IP and host name.

-PE; -PP; -PM (ICMP Ping Types) . In addition to the unusual TCP, UDP and SCTP host discovery types discussed previously, Nmap can send the standard packets sent by the ubiquitous ping program. Nmap sends an ICMP type 8 (echo request) packet to the target IP addresses, expecting a type 0 (echo reply) in return from available hosts.. Unfortunately for network explorers, many hosts and firewalls now block these packets, rather than responding as required by RFC 1122[2]. For this reason, ICMP-only scans are rarely reliable enough against unknown targets over the Internet. But for system administrators monitoring an internal network, they can be a practical and efficient approach. Use the -PE option to enable this echo request behavior.

-A (Aggressive scan options) . This option enables additional advanced and aggressive options.

21,23,80,3389 Ports to search through

192.168.1.* Range of IPs. replace with yours.

share|improve this answer
-sP is for "scanPing", it is also -sn in never versions of nmap it seems. – meawoppl May 12 '15 at 18:14

You can use arp command:

arp -an

But you can only use this command in LAN, if you want to find out the MAC address of any remote host, maybe you must use some tool to capture the packet like tcpdump and parsing the result.

share|improve this answer
tcpdump(8) will only show you the local MACs (i.e., the MAC of the last leg router). The MAC layer headers of input packets are stripped out by the router, and new ones added to the outgoing packet. – vonbrand Feb 9 at 15:15

Why are you doing this? The whole networking stack is build to make this irrelevant. Plus, there are reasonable setups where the same MAC address belongs to different IP addresses (for example, you can assign several IP addresses to an interface, of you can set up an interface to get traffic to be forwarded elsewhere), and moreover an interface does answer to several MAC addresses (at least some form of broadcast, multicast addresses, and higher-end interfaces can be configured with several MACs). Don't forget DHCP, which is designed to "loan" IP addresses on demand to interfaces (MACs) which join the network. There is no one-one relation between IP and MAC, and the relation does change over time. The machinery handling this is complex, just use arp(1) or its replacement ip neigh (see ip(1)) when you need it.

share|improve this answer

Or you can just use arping -c 1 host and it will return the MAC address in the response.

share|improve this answer
arping also needs to be told which interface to use, with the -I option. – Stephen Kitt Feb 9 at 14:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.