[cyph34r]

ntxploits, on Oct 12 2005, 05:33 AM, said:

hi guys...let say i have a mac address...what should i do to get their ip address..

thanx.. :)

there isnt a formula or program to convert mac to ip, if thats what you mean, but you can run arp in cmd.exe in windows to see some ip/mac address info, I think arp -a will list some of the networks ips with their macs, Im not sure if that can help you... you could use Advanced IP Scanner from the download section of radmin.com to scan networks and it will list both the ip and mac addresses. Hopefully that helps you...

[belgther]

In a network, the ARP protocol does what you mean. It queries the IP from MAC and vice versa.

[0X86F4]

belgther, on Oct 13 2005, 11:15 AM, said:

In a network, the ARP protocol does what you mean. It queries the IP from MAC and vice versa.

Actually the protocol used for this purpose is RARP.

You can try arping to retrieve the ip of a mac. The sources can be found in freshmeat.

[dfx]

Thanks, 0X86F4! I've been looking for the answer to this question as well.

Are you aware of any Windows based tools that perform the same task?

Currently, Ive been using the new nmap 3.93 and a couple of awk/grep statements to find the MAC from a network wide arp sweep. Clumsy and semi-efficent way to do it, but it does work. :)

[jay4662002]

ntxploits, on Oct 12 2005, 05:33 AM, said:

hi guys...let say i have a mac address...what should i do to get their ip address..

thanx.. :)

u can try doing a reverse DNS lookup of the MAC address to return the IP an Host name of the system or if your on a local machine u can just ipconfig /all from the command prompt to return the ip default gateway mac address local DNS server addresses local DHCP WINs server and a whole lot more hope that helps ya some

peace out

[f0rk]

synthetic darkness, on Oct 18 2005, 05:59 AM, said:

u can try doing a reverse DNS lookup of the MAC address to return the IP an Host name of the system or if your on a local machine u can just ipconfig /all from the command prompt to return the ip default gateway mac address local DNS server addresses local DHCP WINs server and a whole lot more hope that helps ya some

peace out

You cannot do a reverse DNS lookup on a MAC address.

And, I'm surprised it hasn't been mentioned in here yet, but RARP uses layer 2 broadcasts (which routers don't forward), so RARP requests made for MACs on other networks will not work.

[click]

In short, if the MAC address you are trying to find the IP for is not on your local network, or you do not have access to send ARP packets within it's local network, then you are not able to get the IP from the MAC address. You can however get the MAC address from the IP, just not vice-versa.

[f0rk]

click, on Oct 20 2005, 08:02 PM, said:

In short, if the MAC address you are trying to find the IP for is not on your local network, or you do not have access to send ARP packets within it's local network, then you are not able to get the IP from the MAC address. You can however get the MAC address from the IP, just not vice-versa.

ARP uses hardware broadcasts too, so how can you get the MAC from an IP when it isn't on your local network?

[humbala]

You don't.

If you do an arp request for an IP that's not on your local segment it will be intercepted by your routing device (router, bridge, fw, etc...). That device will say he has the IP/MAC you're looking for. It will then accept every packet you send to that ip and forward it to another segment (where it might be intercepted by other routers etc until the packet reaches it's destination or until the TTL of your packet times out).

[PeppeLePew]

ntxploits, bear in mind that your isp's routers will not foreward ARP packets. ARP will only work on local networks, not the internet

[Core-TX]

If you do whant to have some fun with arp/rarp and Mac adresses, and own a cable modem. Then make a mac bridge, and/or fake it the same as your gateway. Interesting stuff can be found this way.

( cable network ISP's , place your modem, usually, in a 10.x.x.x / 255.0.0.0 network, which after that is routed. And note that the modem has 2 IP's. One @ the HFC side, and one @the ETH side )

Enjoy ;)

adding legit example without, "tricks"
Now you can get to toy more easy :)

Tracing route to governmentsecurity.org [63.251.83.148]
over a maximum of 30 hops:

  1	 9 ms	 9 ms	 7 ms  10.118.2.1 <- My ISP ! 
  2	 5 ms	 8 ms	 7 ms  10.5.6.13   <- My ISP ! 
  3	 8 ms	 6 ms	 7 ms  10.5.32.1	<- My ISP ! 
  4	 6 ms	11 ms	 9 ms  194.134.178.149
  5	 7 ms	11 ms	25 ms  194.134.178.149
  6	 9 ms	14 ms	 9 ms  G6-6.cr1-asd5.nl.euro.net [194.134.161.53]
  7	 8 ms	 6 ms	41 ms  gi2-0.amsbb1.Amsterdam.opentransit.net [193.251.
254.117]
  8	52 ms	23 ms	25 ms  acr1-so-4-0-0.Amsterdamamx.savvis.net [208.174.4
9.29]
  9	28 ms	29 ms	29 ms  bcs1-so-1-2-0.Londonlnx.savvis.net [204.70.193.1
46]
 10	99 ms	98 ms   101 ms  bcs2-so-0-0-0.NewYork.savvis.net [204.70.192.121
]
 11	97 ms   101 ms	99 ms  bcs1-so-6-0-0.NewYork.savvis.net [204.70.192.37]

 12   102 ms   102 ms   103 ms  bcs1-so-6-0-0.Washington.savvis.net [204.70.192.
5]
 13   104 ms   103 ms   102 ms  cpr1-pos-0-0.VirginiaEquinix.savvis.net [208.173
.52.113]
 14	95 ms	95 ms	97 ms  internap.VirginiaEquinix.savvis.net [208.173.10.
178]
 15	94 ms	95 ms	96 ms  border1.pc1-bbnet1.wdc002.pnap.net [216.52.127.1
8]
 16	99 ms	96 ms	97 ms  neovera-14.border1.ext1.wdc.pnap.net [66.150.126
.50]
 17	 *		*		*	 Request timed out.
 18   133 ms	95 ms	95 ms  63.251.83.148

Trace complete.

This post has been edited by Core-TX: 14 November 2005 - 06:35 PM