Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

In the "Network" section of Windows 7, I can see a new device connected to the network. I'm not sure what that device is , so I intend to block it from the network at the router level - mostly to see if something goes wrong so at least we'll know what's connected to it.

However to do that I'll need its MAC address - which I can obtain from the router itself - provided I obtain its local ip address somehow.

Is there a way of doing so ? I don't have access to this device, and assume that there are too many devices connected for me to whitelist. What I basically want is to turn a network path "\....." to an ip address.

EDIT:

I tried pinging it. However the name of this device is just numbers, so ping is resolving it to a 0.0.0.x ip address which fails.

EDIT (to clarify):

I don't need to get the Mac/IP address of this machine I'm on. What I need is to get the Mac/Ip address of another device which is connected to the same network as this machine and which I can observe from network. I have no idea what this device is and I have no access to it.

Clarification

share|improve this question
    
Do you know what the device is? Printer? Workstation? Is your network hardware (router/switch) managed? i.e., do you have command line interaction with them? –  JoshP Jun 27 '12 at 12:10
    
I have no idea what the device is, that's the problem. I want to block it both for security purposes and for determining what goes wrong when I do. I don't have any interface with them. –  Aabela Jun 27 '12 at 12:11
1  
Why do you want to get the MAC address of another device exactly? –  Ramhound Jun 27 '12 at 12:22
1  
So I can block it from the network using the router. –  Aabela Jun 27 '12 at 12:24

4 Answers 4

up vote 1 down vote accepted

I'm confused as to why your ping isn't working, if Windows can see the device then ping should resolve it. Can you show us the error message for your ping?

Otherwise I would suggest "nbtstat -c" or "ipconfig /displaydns" to view NetBios and DNS resolved names respectively. For DNS you might want to run "ipconfig /flushdns" first and then connect to the device again before doing this or else you will see all cached DNS entries.

share|improve this answer
    
(Yes, its called 74) ping 74 Pinging 0.0.0.74 with 32 bytes of data: PING: transmit failed. General failure. PING: transmit failed. General failure. PING: transmit failed. General failure. PING: transmit failed. General failure. Ping statistics for 0.0.0.74: Packets: Sent = 4, Received = 0, Lost = 4 (100% loss), –  Aabela Jun 27 '12 at 12:53
    
nbtstat -c seems to have done the trick though. Its not listing EVERYTHING but its listing the unknown item. –  Aabela Jun 27 '12 at 12:54
    
'nbstat -c' should list NetBios names that you have resolved, the other names probably haven't been resolved or have been resolved by something other than NetBios. –  Sam Jun 27 '12 at 13:07

I can list two ways:

  • Using "arp -a" command:

It will return you the ARP(Address Resolution Protocol) cache table from the registred interfaces that you computer recently exchange messages:

enter image description here

Wireshark will sniff your interface and you can just filter the IP address that you want to know it's MAC addres(from Ethernet layer of a sniffed TCP/IP package):

enter image description here

share|improve this answer
    
@Aabela Please tell me if I this is what you really wanted... –  Diogo Jun 27 '12 at 11:55
    
While that does give me a list of ip addresses, it doesn't give me any insight on what they belong to. I have more than one device on this network and some of them actually belong. I need a way of getting a specific ip address. –  Aabela Jun 27 '12 at 12:10
    
You mean, to type an address and get it's MAC??? To do that, just ping the address and then type arp -a command again... Arp table will be updated with every new IP that you get a return message... –  Diogo Jun 27 '12 at 12:14
    
If the device is being showed by its WINS name(Jonh-PC for example), just ping it as the showed name(ping jonh-pc) –  Diogo Jun 27 '12 at 12:18
    
Pinging it doesn't seem to work for some reason as I've explained above. The item i'm trying to ping is composed of numbers so ping is resolving it incorrect as being an ip address. " and ' don't work, neither does -a –  Aabela Jun 27 '12 at 12:18

If the remote systems are Windows, then you can get the MAC address with this command:

nbtstat -a RemoteName

This will return something like this:

   Name               Type         Status
---------------------------------------------
RemoteName        <00>  UNIQUE      Registered
OurDomain         <00>  GROUP       Registered
RemoteName        <20>  UNIQUE      Registered
OurDomain         <1E>  GROUP       Registered

MAC Address = 00-18-8B-33-FA-99

One very nice thing about using this method, is that it will work across VLANs. The arp -a method will only work after pinging the remote device and if it is located on the same VLAN (or broadcast domain, subnet).

share|improve this answer
    
Apparently its not windows then. I tried the command with the unknown device and another device which doesn't run windows - and I get the MAC address of 00-00-00-00-00-00. Doing it for a windows machine gives a useful MAC address. Note sure what the rest of the data is though. –  Aabela Jun 27 '12 at 12:52
1  
There are a number of different switches you may want to try too. They are referenced on this Microsoft technet page. –  JoshP Jun 27 '12 at 12:59

You can try nslookup.

nslookup <machine_name/IP>
share|improve this answer
    
It's querying the ISP's ns server and it therefore can't find the domain. –  Aabela Jun 27 '12 at 12:48
    
In PowerShell you could try this: [System.Net.Dns]::GetHostAddresses("0.0.0.x") –  Radoo Jun 27 '12 at 13:01

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.