3

In the "Network" section of Windows 7, I can see a new device connected to the network. I'm not sure what that device is , so I intend to block it from the network at the router level - mostly to see if something goes wrong so at least we'll know what's connected to it.

However to do that I'll need its MAC address - which I can obtain from the router itself - provided I obtain its local ip address somehow.

Is there a way of doing so ? I don't have access to this device, and assume that there are too many devices connected for me to whitelist. What I basically want is to turn a network path "\....." to an ip address.

EDIT:

I tried pinging it. However the name of this device is just numbers, so ping is resolving it to a 0.0.0.x ip address which fails.

EDIT (to clarify):

I don't need to get the Mac/IP address of this machine I'm on. What I need is to get the Mac/Ip address of another device which is connected to the same network as this machine and which I can observe from network. I have no idea what this device is and I have no access to it.

Clarification

4
  • Do you know what the device is? Printer? Workstation? Is your network hardware (router/switch) managed? i.e., do you have command line interaction with them?
    – JoshP
    Jun 27, 2012 at 12:10
  • I have no idea what the device is, that's the problem. I want to block it both for security purposes and for determining what goes wrong when I do. I don't have any interface with them.
    – Aabela
    Jun 27, 2012 at 12:11
  • 1
    Why do you want to get the MAC address of another device exactly?
    – Ramhound
    Jun 27, 2012 at 12:22
  • 1
    So I can block it from the network using the router.
    – Aabela
    Jun 27, 2012 at 12:24

5 Answers 5

2

I'm confused as to why your ping isn't working, if Windows can see the device then ping should resolve it. Can you show us the error message for your ping?

Otherwise I would suggest "nbtstat -c" or "ipconfig /displaydns" to view NetBios and DNS resolved names respectively. For DNS you might want to run "ipconfig /flushdns" first and then connect to the device again before doing this or else you will see all cached DNS entries.

3
  • (Yes, its called 74) ping 74 Pinging 0.0.0.74 with 32 bytes of data: PING: transmit failed. General failure. PING: transmit failed. General failure. PING: transmit failed. General failure. PING: transmit failed. General failure. Ping statistics for 0.0.0.74: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
    – Aabela
    Jun 27, 2012 at 12:53
  • nbtstat -c seems to have done the trick though. Its not listing EVERYTHING but its listing the unknown item.
    – Aabela
    Jun 27, 2012 at 12:54
  • 'nbstat -c' should list NetBios names that you have resolved, the other names probably haven't been resolved or have been resolved by something other than NetBios.
    – Sam
    Jun 27, 2012 at 13:07
4

I can list two ways:

  • Using "arp -a" command:

It will return you the ARP(Address Resolution Protocol) cache table from the registred interfaces that you computer recently exchange messages:

enter image description here

Wireshark will sniff your interface and you can just filter the IP address that you want to know it's MAC addres(from Ethernet layer of a sniffed TCP/IP package):

enter image description here

7
  • @Aabela Please tell me if I this is what you really wanted...
    – Diogo
    Jun 27, 2012 at 11:55
  • While that does give me a list of ip addresses, it doesn't give me any insight on what they belong to. I have more than one device on this network and some of them actually belong. I need a way of getting a specific ip address.
    – Aabela
    Jun 27, 2012 at 12:10
  • You mean, to type an address and get it's MAC??? To do that, just ping the address and then type arp -a command again... Arp table will be updated with every new IP that you get a return message...
    – Diogo
    Jun 27, 2012 at 12:14
  • If the device is being showed by its WINS name(Jonh-PC for example), just ping it as the showed name(ping jonh-pc)
    – Diogo
    Jun 27, 2012 at 12:18
  • Pinging it doesn't seem to work for some reason as I've explained above. The item i'm trying to ping is composed of numbers so ping is resolving it incorrect as being an ip address. " and ' don't work, neither does -a
    – Aabela
    Jun 27, 2012 at 12:18
2

you can use Advanced IP Scanner for this purpose

when you start scanning, program will check network and monitor all devices. also you can see shared folder or printers

see an example :

enter image description here

0
1

If the remote systems are Windows, then you can get the MAC address with this command:

nbtstat -a RemoteName

This will return something like this:

   Name               Type         Status
---------------------------------------------
RemoteName        <00>  UNIQUE      Registered
OurDomain         <00>  GROUP       Registered
RemoteName        <20>  UNIQUE      Registered
OurDomain         <1E>  GROUP       Registered

MAC Address = 00-18-8B-33-FA-99

One very nice thing about using this method, is that it will work across VLANs. The arp -a method will only work after pinging the remote device and if it is located on the same VLAN (or broadcast domain, subnet).

2
  • Apparently its not windows then. I tried the command with the unknown device and another device which doesn't run windows - and I get the MAC address of 00-00-00-00-00-00. Doing it for a windows machine gives a useful MAC address. Note sure what the rest of the data is though.
    – Aabela
    Jun 27, 2012 at 12:52
  • 1
    There are a number of different switches you may want to try too. They are referenced on this Microsoft technet page.
    – JoshP
    Jun 27, 2012 at 12:59
1

You can try nslookup.

nslookup <machine_name/IP>
2
  • It's querying the ISP's ns server and it therefore can't find the domain.
    – Aabela
    Jun 27, 2012 at 12:48
  • In PowerShell you could try this: [System.Net.Dns]::GetHostAddresses("0.0.0.x")
    – user127350
    Jun 27, 2012 at 13:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .