56

I need to write a bash script wherein I have to create a file which holds the details of IP Addresses of the hosts and their mapping with corresponding MAC Addresses.

Is there any possible way with which I can find out the MAC address of any (remote) host when IP address of the host is available?

Improve this question

5 Answers 5

Reset to default
61

If you just want to find out the MAC address of a given IP address you can use the command arp to look it up, once you've pinged the system 1 time.

Example

$ ping skinner -c 1
PING skinner.bubba.net (192.168.1.3) 56(84) bytes of data.
64 bytes from skinner.bubba.net (192.168.1.3): icmp_seq=1 ttl=64 time=3.09 ms

--- skinner.bubba.net ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 3.097/3.097/3.097/0.000 ms

Now look up in the ARP table:

$ arp -a
skinner.bubba.net (192.168.1.3) at 00:19:d1:e8:4c:95 [ether] on wlp3s0

fing

If you want to sweep the entire LAN for MAC addresses you can use the command line tool fing to do so. It's typically not installed so you'll have to go download it and install it manually.

$ sudo fing 10.9.8.0/24

    fing example

Using ip

If you find you don't have the arp or fing commands available, you could use iproute2's command ip neigh to see your system's ARP table instead:

$ ip neigh
192.168.1.61 dev eth0 lladdr b8:27:eb:87:74:11 REACHABLE
192.168.1.70 dev eth0 lladdr 30:b5:c2:3d:6c:37 STALE
192.168.1.95 dev eth0 lladdr f0:18:98:1d:26:e2 REACHABLE
192.168.1.2 dev eth0 lladdr 14:cc:20:d4:56:2a STALE
192.168.1.10 dev eth0 lladdr 00:22:15:91:c1:2d REACHABLE

References

Improve this answer
5
  • I know this is an old answer, but do you have any insight as to how Fing is implemented? I am trying to learn about this layer of networking and the tools to monitor it.
    – akaphenom
    Mar 8, 2016 at 20:31
  • 1
    @akaphenom If you have new questions please them outright, comments aren't meant for that.
    – slm ♦
    Mar 9, 2016 at 0:33
  • but isn't arp deprecated? How can I do this with ip?
    – math2001
    Nov 23, 2019 at 0:50
  • 1
    @math2001 - it wasn't 5 yrs ago, I added an example showing how using ip.
    – slm ♦
    Nov 23, 2019 at 13:43
  • 1
    The ip neigh works most of the times without having to install extra packages. Therefore I think that's the best answer.
    – Tobias Holm
    Jan 1, 2021 at 13:01
11

You can use arp command:

arp -an

But you can only use this command in LAN, if you want to find out the MAC address of any remote host, maybe you must use some tool to capture the packet like tcpdump and parsing the result.

Improve this answer
1
  • 2
    tcpdump(8) will only show you the local MACs (i.e., the MAC of the last leg router). The MAC layer headers of input packets are stripped out by the router, and new ones added to the outgoing packet.
    – vonbrand
    Feb 9, 2016 at 15:15
9

This is from my question and answer in Ask Ubuntu.

You can use the command

sudo nmap -sP -PE -PA21,23,80,3389 192.168.1.*

nmap: Network exploration tool and security / port scanner. From the manual:

-sP (Skip port scan): This option tells Nmap not to do a port scan after host discovery, and only print out the available hosts that responded to the scan. This is often known as a “ping scan”, but you can also request that traceroute and NSE host scripts be run. This is by default one step more intrusive than the list scan, and can often be used for the same purposes. It allows light reconnaissance of a target network without attracting much attention. Knowing how many hosts are up is more valuable to attackers than the list provided by list scan of every single IP and host name.

-PE; -PP; -PM (ICMP Ping Types): In addition to the unusual TCP, UDP and SCTP host discovery types discussed previously, Nmap can send the standard packets sent by the ubiquitous ping program. Nmap sends an ICMP type 8 (echo request) packet to the target IP addresses, expecting a type 0 (echo reply) in return from available hosts.. Unfortunately for network explorers, many hosts and firewalls now block these packets, rather than responding as required by RFC 1122[2]. For this reason, ICMP-only scans are rarely reliable enough against unknown targets over the Internet. But for system administrators monitoring an internal network, they can be a practical and efficient approach. Use the -PE option to enable this echo request behavior.

-PA port list (TCP ACK Ping): The TCP ACK ping is quite similar to the just-discussed SYN ping. The difference, as you could likely guess, is that the TCP ACK flag is set instead of the SYN flag. Such an ACK packet purports to be acknowledging data over an established TCP connection, but no such connection exists. So remote hosts should always respond with a RST packet, disclosing their existence in the process. The -PA option uses the same default port as the SYN probe (80) and can also take a list of destination ports in the same format. If an unprivileged user tries this, the connect workaround discussed previously is used. This workaround is imperfect because connect is actually sending a SYN packet rather than an ACK.

21,23,80,3389: Ports to search through.

192.168.1.*: Range of IPs. replace with yours.

Improve this answer
1
  • -sP is for "scanPing", it is also -sn in never versions of nmap it seems.
    – meawoppl
    May 12, 2015 at 18:14
6

arping

arping -I <interface> -c 1 <host>

The command should return the MAC address in the response. Something like,

$ arping -I eth0 -c1 192.168.1.2
ARPING 192.168.1.2 from 192.168.1.5 eth0
Unicast reply from 192.168.1.2 [08:01:27:38:EF:32]  0.746ms
Sent 1 probes (1 broadcast(s))
Received 1 response(s)

arping is provided by package iputils-arping on Debian.

Improve this answer
2
  • arping also needs to be told which interface to use, with the -I option.
    – Stephen Kitt
    Feb 9, 2016 at 14:09
  • You can use arping -f to quit after the first reply.
    – Ryan Griggs
    Sep 28, 2018 at 13:49
1

The name of the active network device for my computer can be found using:
ip neigh | grep 192.168.2.1 | awk 'BEGIN{FS=" ";}{print $3;}'
where 192.168.2.1 is the ip address of my local network router.

For my computer this command returns: enp6s0

Using this interface name, the mac address of my computer can be obtained using:
cat /sys/class/net/enp6s0/address

Using backticks to surround the first command, both commands can be combined into a one-liner like this:
cat /sys/class/net/`ip neigh | grep 192.168.2.1 | awk 'BEGIN{FS=" ";}{print $3;}'`/address

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .