Ressolving a MAC address

J.B

J.B

J.B

Soldato
Joined
16 Aug 2006
Posts
5,924
Hey guys, was wondering if someone could help me with a project Im working on. Basicly I have the MAC address but need to find a the IP, dont have access to the router so cant look at the DHCP allocation table.

I have a feeling I want to do some sort of inverse ARP.

Any words of wisdom as Im stumped! :confused:
 
command > arp

X:\>arp

Displays and modifies the IP-to-Physical address translation tables used by
address resolution protocol (ARP).

ARP -s inet_addr eth_addr [if_addr]
ARP -d inet_addr [if_addr]
ARP -a [inet_addr] [-N if_addr]

-a Displays current ARP entries by interrogating the current
protocol data. If inet_addr is specified, the IP and Physical
addresses for only the specified computer are displayed. If
more than one network interface uses ARP, entries for each ARP
table are displayed.
-g Same as -a.
inet_addr Specifies an internet address.
-N if_addr Displays the ARP entries for the network interface specified
by if_addr.
-d Deletes the host specified by inet_addr. inet_addr may be
wildcarded with * to delete all hosts.
-s Adds the host and associates the Internet address inet_addr
with the Physical address eth_addr. The Physical address is
given as 6 hexadecimal bytes separated by hyphens. The entry
is permanent.
eth_addr Specifies a physical address.
if_addr If present, this specifies the Internet address of the
interface whose address translation table should be modified.
If not present, the first applicable interface will be used.
Example:
> arp -s 157.55.85.212 00-aa-00-62-c6-09 .... Adds a static entry.
> arp -a .... Displays the arp table.
 
Yeah I got as far as arp -a, but that only maps ones that are in the arp table. So if Id pinged it already it would appear in the arp table, but I dont know the IP.
 
ARP Tools website said:
This tool cannot 'ping' a MAC address and get an IP address back in return -- the ARP protocol does not work that way
Click to expand...

Doesnt look like its gonna help, or that ARP is the answer for me!

Anyone else got any ideas?
 
Could you perhaps use some kind of network scanner to scan your local network? Assuming you've a rough idea of the IP range it should be trivial to scan that range for IPs and match up the MACs to that.

Not exactly high tech but...
 
Just using an IP scanner now, seems like the kind of thing that will work, however, I think scanning all the IPs might be the kind of thing that ruffles the feathers of the network admins.

Its for my dissertation and the people who manage the network wouldnt give me a static IP for security reasons :o
 
Umm well half and half, the IP scanner I used didnt display MAC addresses so once I've pinged all the clients I then have to arp -a to display the table, then go throught it to find the matching MAC to what Im looking for.

Im thinking of writing my own batch file that will do this and filter out the correct MAC address.

Its not perfect though as the address range is 10.91.YY.XX where YY iss 2-15 and XX is 1-255, so its a lot of IP addresses.

Its a real problem but im sure it will have a solution.
 
Get a program called Advanced IP Scanner. Once its finished scanning, just highlight all the active PC's, right click and then select "get NetBIOS Info"; this should display the MAC address of selected NIC's.

Also with that network scanner, as its scanned all machines.. it basicalled pinged them to see if they're alive, so you can do a ARP -a and it should list all machines you scanned and their IP <-> MAC
 
You must log in or register to reply here.
Back
Top Bottom