Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to find a IP address of a specific user and I only have the Mac address available, I'm using Ubuntu. Is this possible?

share|improve this question
up vote 5 down vote accepted

There no gaurantee that you will be able to do so, but you can try to use ARP to look up what addresses are known to the system you are on (on windows, the command is arp -g). But the arp cache expires and only systems that have "talked" to the system you are on will be displayed like this. Even then, if the machine is behind a router, you will only get the router IP address.

If you have access to the DHCP server, you may be able to look up the MAC address there and see what IP address it got. PROVIDED your network is using DHCP.

share|improve this answer

Best sure-fire way is to access your router (most routers have a stored list of connected clients, their MACs, and corresponding IP addresses).

It's usually called a CLIENT TABLE. Also as Multiverse IT have suggested, look into the DHCP server.

Finally, arp -g, but it is not very reliable, especially if the terminal you want to identify has not connected to you in awhile.

Even better... get a network topology mapper/sniffer, such as NMAP, which I use extensively when I get deployed in strange foreign networks.

share|improve this answer

Try scanning your local network using nmap. If your target machine is connected, a simple grep for the relevant mac address should map it to the IP address.

[root@myhost ~]# nmap -nsP

Starting Nmap 4.20 ( ) at 2009-09-08 09:25 BST
Host appears to be up.
MAC Address: 00:aa:bb:bb:7D:21 (Hewlett-Packard Company)
Host appears to be up.
MAC Address: 00:aa:bb:bb:B6:64 (Dell)
Host appears to be up.
MAC Address: 00:aa:bb:bb:8F:2E (Micro-star International CO.)
Host appears to be up.
MAC Address: 00:aa:bb:bb:9D:1B (Tyan Computer)
Host appears to be up.
MAC Address: 00:aa:bb:bb:91:39 (Tyan Computer)

To be pedantic, you can then ping the host then check your arp table. Say you're looking for 00:aa:bb:bb:91:39 which is shown to have the IP

[root@myhost ~] ping
[root@myhost ~] arp -n | awk '/{print $1 " - "$3}'   00:aa:bb:bb:91:39
share|improve this answer

You could try spoofing your MAC address as the one in question. If DHCP, should trigger you to get the same address as well as creating an IP conflict. This in turn can have the person in question pop their head up wondering why they're having network trouble. Dirty way to find out, but it could work hehe.

share|improve this answer

There are very many software products that can scan a sub-network for ARP and more.
A quick googling found these examples:
Free IP Scanner 1.6
Colasoft Mac Scanner Pro (free for non-commercial users)

share|improve this answer
Free IP Scanner 1.6 Platform: Windows 9x/Me/NT/2000/XP/2003/Vista/7 Colasoft MAC Scanner Download URL: cmac11_build210.exe – briealeida Nov 2 '09 at 17:04

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.