Resolving MAC Address from IP Address in Linux

  • I need to write a bash script wherein I have to create a file which holds the details of IP Addresses of the hosts and their mapping with corresponding MAC Addresses.

    Is there any possible way with which I can find out the MAC address of any (remote) host when IP address of the host is available?

  • slm

    slm Correct answer

    7 years ago

    If you just want to find out the MAC address of a given IP address you can use the command arp to look it up, once you've pinged the system 1 time.

    Example

    $ ping skinner -c 1
    PING skinner.bubba.net (192.168.1.3) 56(84) bytes of data.
    64 bytes from skinner.bubba.net (192.168.1.3): icmp_seq=1 ttl=64 time=3.09 ms
    
    --- skinner.bubba.net ping statistics ---
    1 packets transmitted, 1 received, 0% packet loss, time 0ms
    rtt min/avg/max/mdev = 3.097/3.097/3.097/0.000 ms
    

    Now look up in the ARP table:

    $ arp -a
    skinner.bubba.net (192.168.1.3) at 00:19:d1:e8:4c:95 [ether] on wlp3s0
    

    fing

    If you want to sweep the entire LAN for MAC addresses you can use the command line tool fing to do so. It's typically not installed so you'll have to go download it and install it manually.

    $ sudo fing 10.9.8.0/24
    

        fing example

    Using ip

    If you find you don't have the arp or fing commands available, you could use iproute2's command ip neigh to see your system's ARP table instead:

    $ ip neigh
    192.168.1.61 dev eth0 lladdr b8:27:eb:87:74:11 REACHABLE
    192.168.1.70 dev eth0 lladdr 30:b5:c2:3d:6c:37 STALE
    192.168.1.95 dev eth0 lladdr f0:18:98:1d:26:e2 REACHABLE
    192.168.1.2 dev eth0 lladdr 14:cc:20:d4:56:2a STALE
    192.168.1.10 dev eth0 lladdr 00:22:15:91:c1:2d REACHABLE
    

    References

    I know this is an old answer, but do you have any insight as to how Fing is implemented? I am trying to learn about this layer of networking and the tools to monitor it.

    @akaphenom If you have new questions please them outright, comments aren't meant for that.

    but isn't `arp` deprecated? How can I do this with `ip`?

    @math2001 - it wasn't 5 yrs ago, I added an example showing how using `ip`.

License under CC-BY-SA with attribution


Content dated before 6/26/2020 9:53 AM