50

I know the IP address of a host on my own LAN. Using that, how can I find its MAC address (without having to physically access it)?

Improve this question

11 Answers 11

Reset to default
63

If you are on a Windows machine, open a command box (Start...Run...cmd), ping the target machine so you have made contact with it, and then issue the command arp -a to view your local ARP table, which will list IP addresses and their corresponding MAC addresses, e.g.,

C:\Users\L3K> arp -a

Interface: 192.168.200.128 --- 0xb
  Internet Address      Physical Address      Type
  192.168.200.1         00-50-7f-c3-5c-88     dynamic
  192.168.200.2         00-50-7f-d1-e1-40     dynamic
  192.168.200.6         00-80-77-dd-a8-6b     dynamic

If you are on a Linux-based system, install the arp-scan utility, and then from a command line you can ask for a scan of your network - in my case:

sudo arp-scan 192.168.200.0/24

If you are using an interface other than Ethernet, say, wireless, you will need to specify that, such as 

sudo arp-scan -I wlan0 192.168.200.0/24

If you don't know what interface you're using, simply use the appropriate command below.

ifconfig  (For Debian based OS such as Ubuntu)
ip link   (For OS like Arch Linux)
Improve this answer
4
  • 21
    Will work only if other host is on the same LAN segment.
    – AnonymousLurker
    Commented Oct 1, 2012 at 6:49
  • 1
    @Linker3000, What's the point of ping before arp -a?
    – Pacerier
    Commented Nov 10, 2015 at 16:23
  • 6
    @Pacerier - the arp command shows the contents of the Address Resolution Protocol cache, which maps IP addresses to the hardware (mac) addresses . If you haven't contacted the target ip address, then it won't be in the cache. Ping is a simple way to contact it to add it to the cache. You could use any network command, it's just ping is an easy one.
    – Kevin Jones
    Commented Dec 9, 2015 at 11:33
  • 1
    @Pacerier great question, there is an intrinsic APR lookup that happens when you ping a device, so it makes sure that the apr address is actually already available in your table.
    – Mark Tomlin
    Commented Jun 16, 2021 at 10:29
23

The command arping comes with the iputils package on linux. Specify an ip address to ping and it returns the MAC address, even across switches and subnets on the LAN (at least it does on our LAN).

# arping -c 1 -I eth0 10.100.10.11
ARPING 10.100.10.11 from 10.100.10.25 eth0
Unicast reply from 10.100.10.11 [00:22:68:88:F3:90]  0.594ms
Sent 1 probes (1 broadcast(s))
Received 1 response(s)
Improve this answer
2
  • 1
    In Debian, there are 2 packages: arping and iputils-arping. The arping package worked for me, though network interface is specified with a lower-case i: arping -c 1 -i eth0 10.100.10.11
    – chronos
    Commented Feb 25, 2015 at 11:11
  • This gave me the error arping: socket: Address family not supported by protocol.
    – user74094
    Commented Apr 9 at 10:59
8

Try

getmac /s hostname

or:

getmac /s IP

You need admin access to the machine to do this.

Improve this answer
4
  • 1
    Why not just use arp -a which doesn't need admin access?
    – Pacerier
    Commented Nov 10, 2015 at 16:22
  • RPC server not available....
    – Antoni Gual Via
    Commented May 5, 2022 at 6:57
  • @Pacerier static ip of remote computer won't be visible in arp table list
    – alexsuslin
    Commented May 2, 2023 at 6:59
  • @Pacerier arp gives me the error /proc/net/arp: No such file or directory.
    – user74094
    Commented Apr 9 at 11:02
4

If both your machine and the target machine are on the same subnet, you can just ping it to cause its IP⟷MAC association to be registered via Address Resolution Protocol (ARP).

ping -c1 $IP
arp -n | grep $IP

for example if I want to find the IP of 10.1.135.150:

# ping -c1 10.1.135.150
PING 10.1.135.150 (10.1.135.150) 56(84) bytes of data.
64 bytes from 10.1.135.150: icmp_seq=1 ttl=64 time=1.88 ms

--- 10.1.135.150 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.883/1.883/1.883/0.000 ms

Then query the ARP table

# arp -n | grep 10.1.135.150
10.1.135.150             ether   8c:ae:4c:f4:4d:e1   C                     eth0

So the MAC of 10.1.135.150 is 8c:ae:4c:f4:4d:e1

Improve this answer
1
  • Note modern systems do not have arp installed by default - try using ip neighbour instead
    – RobM
    Commented Sep 1, 2022 at 16:49
3

If you have a managed switch or your router lets you view its ARP table you can get this from there.

If the computer you have the IP for is online you can ping it and get its MAC from you local ARP table.

A general note for the sake of others: it is not possible to obtain the MAC address for machines that are on a different LAN since Layer 3 protocols are used for addressing and delivery in this case and MAC is Layer 2.

Improve this answer
2
  • Didn't really give him any instructions on "how" to do this.
    – GregD
    Commented Feb 13, 2011 at 14:03
  • 3
    In the case of viewing it on the router, you just go to the web interface and hunt around. Can't be much more specific than that since every router has a different layout and set of pages for its web admin. Seems like a harsh -1 to me, especially since I gave more info than MaQleod.
    – imoatama
    Commented Jul 29, 2011 at 14:23
2

just use something like:

nmap -n -sP 192.168.146.0/24

after adapting the params to your setup this will scan your whole subnet giving IP and MAC addrs

Improve this answer
1

As long as there is no gateway routing the traffic between the computers, any sniffer would give you this information.

Improve this answer
1
  • Thanks for the answer Ofir. As a sub-question, is there a way of doing this if the host in question is down? Yes, I could query my own host's ARP cache, but it unfortunately doesn't currently contain the IP I'm interested in. So I was wondering if there's a way to somehow extract say an intermediary router's ARP cache and look up in that?
    – Frederick
    Commented Sep 15, 2010 at 8:20
1

You can use utility like http://trogonsoftware.com/trogon-mac-scanner.html or another ip\mac address scanner to scan network for addresses of remote computers on LAN.

Improve this answer
1
  • There are many free options as well... searching for "IP scanner"
    – JoshP
    Commented Oct 1, 2012 at 12:53
0

You can always consult the arp table on your router (in some cases, the router combines the arp and dhcp lease tables together).

Improve this answer
3
  • Exactly what I'm looking for, but what tools or commands will help me do that?
    – Frederick
    Commented Sep 15, 2010 at 8:22
  • But wait a minute, I am on the same LAN, so there won't be any router right?
    – Frederick
    Commented Sep 15, 2010 at 8:25
  • Typical LANs will have at least one router. Depending on the router, you have different options of how to get it. Most home routers you need to access it using the Web Interface in order to find that information, more complex routers will let you telnet in or query via the console port in order to get that information.
    – MaQleod
    Commented Sep 15, 2010 at 8:31
0

Another way is:

nbtstat -a 192.168.1.1

(replace 192.168.1.1 with desired address)

Also, if getmac is used on a non-Windows computer, you'd get:

ERROR: The RPC server is unavailable.

Improve this answer
-2

The best way is to use ⇾ arp -a IPaddress

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .