I have the following topology:

DeviceX ------
 DeviceX bridge with two Ethernet cards 
      (created with bridge-utils) ---------------- router 
              |                                      |
              |                                      |
DeviceY ------                                       |
                                     other devices on the same network 
                                       (switches, PCs, WiFi devices)

I have complete control over DeviceX - it's a Linux PC and it has two Ethernet adapters, which are bridged with Linux bridge-utils to provide LAN access for both DeviceX and DeviceY.

DeviceY is also a Linux PC, but I have no control over it. I know only that it is using DHCP IP address received from the router through my bridge on DeviceX. DeviceY might get replaced with another physical device at any time, thus I can't just look at its MAC address once and keep it - I need to determine MAC address each time my DeviceX boots or when it detects that one of its two Ethernet connections has been reset (cable disconnected and connected again etc.).

It is always guaranteed that only these two devices will be connected to the bridge on DeviceX, and no one else.

There might be many other devices connected to the router, but I need only the address of DeviceY which is always directly connected to one of two Ethernet ports.

It might not be deal-breaker if I also get address of the router itself - it will be known beforehand and I can filter it out, as long as I have adresses of only two devices - the router and DeviceY.

Now the question: from DeviceX, how do I reliably find MAC or IP address of DeviceY?

More info: I use bridge-utils on DeviceX because DeviceY should be in the same LAN as all the other devices in the LAN. Custom routing from DeviceX to DeviceY is not an option because it would create a new subnetwork and it would require NAT and what not to make DeviceY work as expected. Bridge-utils is the simplest solution.

  • 2
    brctl showmacs? Feb 5, 2015 at 11:12
  • 1
    Or with recent versions of iproute2: bridge fdb show brport eth1 Feb 5, 2015 at 11:23
  • @ Stéphane Chazelas: Thanks, brctl showmacs br0 did the trick. Is it reliable? Will it show learned MAC adresses even if DeviceY hasn't yet received any data, except some communication with the router to retrieve DHCP lease? If it is reliable, you can add your suggestion as an answer, so I can accept it. It would also be great to have some way to find out also IP for each of the MACs I find with showmacs, but that would be another question. Feb 6, 2015 at 20:02

2 Answers 2


A bridge or switch is a device that bridges two segments of a broadcast domain, and segregates the unicast traffic.

To do that the bridge maintains a forwarding table that records which port reaches a given Mac address. That table is filled in when ever a new packet with a new ethernet source address is received, and MAC addresses that have not been seen in a while are removed.

When a bridge/switch receives a frame intended for a given MAC address, if that MAC address is in its forwarding table, it sends it on the corresponding port only, otherwise to all ports.

The Linux implementation is no different.

The forwarding table can be queried with the

 brctl showmacs <bridge-name>

And is otherwise available in /sys/class/net/<bridge-name>/brforward (binary).

You can get a mapping between port number and interface name with:

 grep . /sys/class/net/vmbr0/brif/*/port_no

Or, if on a system with a recent version of iproute2 the new suite of network utilities for Linux, you can get the forwarding table with interface names with:

 bridge fdb show br <bridge-name>

Or to know all the MAC addresses reachable via a given interface or the bridge, for instance eth0:

 bridge fdb show br <bridge-name> brport <interface-name>

The command arp will show all iPs and their MACs, since you only have two computers in your network and the router it will be easy to identify the one that is not your IP nor the router's, and has an IP from your network.

  • But there might be lots of other devices in the same LAN connected to the router and having IP adresses in the same range as DeviceX, DeviceY and the router. I can guarantee that only the bridge will have two connections, but not that there will be no other devices in the same LAN. How do I know which of devices returned by arp are connected directly to my DeviceX? Feb 5, 2015 at 9:30
  • Why does it have to be a bridge? Why not routing from DeviceX instead of bridging?
    – YoMismo
    Feb 5, 2015 at 9:53
  • Both DeviceX and DeviceY will always be close to each other, but far from a router, therefore I need to connect them both to LAN with only one Ethernet cable. Bridging is the cheapest option. But the main problem is that DeviceX needs to identify, which device it is paired with, and the only thing which makes them paired is an Ethernet cable, that's why I need to find the DeviceY at the other end of the cable. Feb 5, 2015 at 10:22
  • Cheapest? routing through DeviceX is for free, unless you don't own that machine and you are being charged for services, otherwise you can route using iptables, that way you can have always identified DeviceY
    – YoMismo
    Feb 5, 2015 at 10:28
  • 1
    Maybe you can have the bridge disabled, and only enable it when Ethernet traffic is detected on the DeviceY side. That way you can identify the MAC address (DeviceY will try to get its DHCP address) so arp will give you the MAC, once you have it identified bring the bridge up until the connection is lost, then you bring the bridge down and start all over again.
    – YoMismo
    Feb 5, 2015 at 14:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.