Discussion Locked

Have MAC Need IP

0 helpful
6 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I am using a network monitoring program which will tell me the MAC address of different hosts sending traffic over my network. I need to find out the IP of certain hosts who are sending relatively high amount of traffic. I have the Mac and need the IP. arp -a only gives me a small list of ip address's associated with MACS. I cant put arp because I don't know the address. Ideas?

6 replies

by astute

As u say an easy way to get a list of MAC to IP addresses on the local subnet is to ping every host on the subnet and then check you ARP cache, however pinging every individual node would take ages and the entries only stay in the ARP cache for 2 minutes.

An alternative is to ping the broadcast mask of your subnet which will ping every host on the local subnet (you can't ping the entire network as you only communicate directly with nodes on the same subnet, all other requests are via the gateway so you would just get a ARP entry for the gateway).

for example you have a subnet mask of 255.255.255.0 for a network 192.168.1.0
then the broadcast mask will be 192.168.1.255.

then use arp -a .

Good luck

by pschuvie

Here are a few ideas you can consider for your quest.

There's a great utility - freeware - called internet maniac. Gives all kinds of conn info including arp and rarp. Address is as follows:
http://network-spy.com/maniac.php

Do you have any Cisco routers connected to the LAN segments? If you can connect to the router, you can issue a "sh arp" command. The router will respond with both the MAC and IP address for every device directly connected to it and tell you which interface the address is being heard from.

If you have DHCP running then in DHCP manager: Scope: Active leases you will get a list of IP addresses (plus NetBIOS names if you also have options 044 & 046 configured to link to WINS).

The Properties of each address includes a Unique Identifier which is the MAC address. You have to work backwards by looking at each IP address and writing or copying the MAC address manually.

HTH

by nettek

If you are running DHCP server, when you view active leases you can highlight an IP address and select properties. This will give you the MAC address associated with that IP address.

This discussion is closed to new replies.