Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a way to get the IP address when all you have is the MAC of an item?

share|improve this question
up vote 8 down vote accepted

If you are connected to the same broadcast domain, you can do arp -a which will show you the ARP cache. From here you can match the MAC to IP.

share|improve this answer

If the target device and your *nix box are on the same IP subnet (and I specifically mean a true IP subnet, not the same switch, or same VLAN, or even the same broadcast domain, or anything else that is sometimes referred to as a "subnet" in layman's terms), and if they have had occasion to talk to talk to each other already, then the target device's IP -> MAC mapping is probably already in your Unix box's ARP table. You can do arp -a to see the table.

If they're on the same subnet but haven't talked to each other yet, you can usually force it by pinging either the all-hosts multicast address ( or the subnet broadcast address.

If you're not on the same IP subnet but you're on the same multicast/broadcast domain, you might be able to get its IP address by running a sniffer and watching for multicasts or broadcasts from the target MAC address:

sudo tcpdump -nei $INTERFACE ether host $MAC

...where $INTERFACE is the interface you want to listen on (maybe "en0" or "eth0" or something like that) and $MAC is the MAC address you're looking for.

To trigger the target device to send multicasts or broadcasts while you're watching with the sniffer, you can do things like ping the addresses I mentioned above, or power-cycle the target device, or unplug the device from the switch (or power-cycle the switch). Most devices are more likely to send broadcasts and multicasts at boot, or when their network link comes up after being down for a while.

share|improve this answer

Yes, it's called arp (Address Resolution Protocol). If you use a program like TCP Dump or Wireshark you will see that every so often the router/network device will ask the equivelant of "Who is [IP]" then the person will respond with their mac address.

If you are using Windows you can just open up a command line and type "arp -a" to list the ARP record you have.

share|improve this answer
arp -a will return the same values on both Windows and Linux – MDMarra Jun 11 '10 at 1:27
Thanks for letting me know MarkM – Daisetsu Jun 11 '10 at 22:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.