Government Security
Network Security Resources

Jump to content

Get Ip Address From Mac Address...

- - - - -
  • Please log in to reply
12 replies to this topic

#1 Guest_ntxploits_*

Guest_ntxploits_*
  • Guests

Posted 12 October 2005 - 01:33 AM

hi guys...let say i have a mac address...what should i do to get their ip address..

thanx.. :)

#2 cyph34r

cyph34r

    Specialist

  • Members
  • 141 posts

Posted 12 October 2005 - 08:41 AM

hi guys...let say i have a mac address...what should i do to get their ip address..

thanx.. :)


there isnt a formula or program to convert mac to ip, if thats what you mean, but you can run arp in cmd.exe in windows to see some ip/mac address info, I think arp -a will list some of the networks ips with their macs, Im not sure if that can help you... you could use Advanced IP Scanner from the download section of radmin.com to scan networks and it will list both the ip and mac addresses. Hopefully that helps you...

#3 belgther

belgther

    Sergeant First Class

  • Sergeant Major
  • 650 posts

Posted 13 October 2005 - 03:15 AM

In a network, the ARP protocol does what you mean. It queries the IP from MAC and vice versa.
"The wisest one is the one who knows himself/herself." Quote of the life
belgther... aka... belgther

#4 0X86F4

0X86F4

    Private First Class

  • Members
  • 41 posts

Posted 17 October 2005 - 11:50 AM

In a network, the ARP protocol does what you mean. It queries the IP from MAC and vice versa.

Actually the protocol used for this purpose is RARP.

You can try arping to retrieve the ip of a mac. The sources can be found in freshmeat.

#5 dfx

dfx

    Private First Class

  • Members
  • 89 posts

Posted 17 October 2005 - 08:04 PM

Thanks, 0X86F4! I've been looking for the answer to this question as well.

Are you aware of any Windows based tools that perform the same task?

Currently, Ive been using the new nmap 3.93 and a couple of awk/grep statements to find the MAC from a network wide arp sweep. Clumsy and semi-efficent way to do it, but it does work. :)

#6 jay4662002

jay4662002

    Private First Class

  • Members
  • 42 posts

Posted 17 October 2005 - 09:59 PM

hi guys...let say i have a mac address...what should i do to get their ip address..

thanx.. :)


u can try doing a reverse DNS lookup of the MAC address to return the IP an Host name of the system or if your on a local machine u can just ipconfig /all from the command prompt to return the ip default gateway mac address local DNS server addresses local DHCP WINs server and a whole lot more hope that helps ya some

peace out

#7 f0rk

f0rk

    Private

  • Members
  • 18 posts

Posted 19 October 2005 - 05:19 PM

u can try doing a reverse DNS lookup of the MAC address to return the IP an Host name of the system or if your on a local machine u can just ipconfig /all from the command prompt to return the ip default gateway mac address local DNS server addresses local DHCP WINs server and a whole lot more hope that helps ya some

peace out


You cannot do a reverse DNS lookup on a MAC address.

And, I'm surprised it hasn't been mentioned in here yet, but RARP uses layer 2 broadcasts (which routers don't forward), so RARP requests made for MACs on other networks will not work.

#8 click

click

    Private First Class

  • Members
  • 76 posts

Posted 20 October 2005 - 12:02 PM

In short, if the MAC address you are trying to find the IP for is not on your local network, or you do not have access to send ARP packets within it's local network, then you are not able to get the IP from the MAC address. You can however get the MAC address from the IP, just not vice-versa.

#9 f0rk

f0rk

    Private

  • Members
  • 18 posts

Posted 20 October 2005 - 04:23 PM

In short, if the MAC address you are trying to find the IP for is not on your local network, or you do not have access to send ARP packets within it's local network, then you are not able to get the IP from the MAC address. You can however get the MAC address from the IP, just not vice-versa.


ARP uses hardware broadcasts too, so how can you get the MAC from an IP when it isn't on your local network?

#10 humbala

humbala

    Private

  • Members
  • 11 posts

Posted 23 October 2005 - 04:34 AM

You don't.

If you do an arp request for an IP that's not on your local segment it will be intercepted by your routing device (router, bridge, fw, etc...). That device will say he has the IP/MAC you're looking for. It will then accept every packet you send to that ip and forward it to another segment (where it might be intercepted by other routers etc until the packet reaches it's destination or until the TTL of your packet times out).

#11 PeppeLePew

PeppeLePew

    Private

  • Members
  • 11 posts

Posted 25 October 2005 - 09:23 AM

ntxploits, bear in mind that your isp's routers will not foreward ARP packets. ARP will only work on local networks, not the internet

#12 Core-TX

Core-TX

    Private First Class

  • Members
  • 73 posts

Posted 14 November 2005 - 06:26 PM

If you do whant to have some fun with arp/rarp and Mac adresses, and own a cable modem. Then make a mac bridge, and/or fake it the same as your gateway. Interesting stuff can be found this way.

( cable network ISP's , place your modem, usually, in a 10.x.x.x / 255.0.0.0 network, which after that is routed. And note that the modem has 2 IP's. One @ the HFC side, and one @the ETH side )

Enjoy ;)

adding legit example without, "tricks"
Now you can get to toy more easy :)

Tracing route to governmentsecurity.org [63.251.83.148]
over a maximum of 30 hops:

  1	 9 ms	 9 ms	 7 ms  10.118.2.1 <- My ISP ! 
  2	 5 ms	 8 ms	 7 ms  10.5.6.13   <- My ISP ! 
  3	 8 ms	 6 ms	 7 ms  10.5.32.1	<- My ISP ! 
  4	 6 ms	11 ms	 9 ms  194.134.178.149
  5	 7 ms	11 ms	25 ms  194.134.178.149
  6	 9 ms	14 ms	 9 ms  G6-6.cr1-asd5.nl.euro.net [194.134.161.53]
  7	 8 ms	 6 ms	41 ms  gi2-0.amsbb1.Amsterdam.opentransit.net [193.251.
254.117]
  8	52 ms	23 ms	25 ms  acr1-so-4-0-0.Amsterdamamx.savvis.net [208.174.4
9.29]
  9	28 ms	29 ms	29 ms  bcs1-so-1-2-0.Londonlnx.savvis.net [204.70.193.1
46]
 10	99 ms	98 ms   101 ms  bcs2-so-0-0-0.NewYork.savvis.net [204.70.192.121
]
 11	97 ms   101 ms	99 ms  bcs1-so-6-0-0.NewYork.savvis.net [204.70.192.37]

 12   102 ms   102 ms   103 ms  bcs1-so-6-0-0.Washington.savvis.net [204.70.192.
5]
 13   104 ms   103 ms   102 ms  cpr1-pos-0-0.VirginiaEquinix.savvis.net [208.173
.52.113]
 14	95 ms	95 ms	97 ms  internap.VirginiaEquinix.savvis.net [208.173.10.
178]
 15	94 ms	95 ms	96 ms  border1.pc1-bbnet1.wdc002.pnap.net [216.52.127.1
8]
 16	99 ms	96 ms	97 ms  neovera-14.border1.ext1.wdc.pnap.net [66.150.126
.50]
 17	 *		*		*	 Request timed out.
 18   133 ms	95 ms	95 ms  63.251.83.148

Trace complete.

Edited by Core-TX, 14 November 2005 - 06:35 PM.


#13 jeeva

jeeva

    Private

  • Members
  • 4 posts

Posted 02 August 2013 - 12:50 AM

Hi here i list out the instruction to find the ip address from mac address . 1.Click the Windows "Start" button and select "Run." In the textbox, type "cmd" and click the "Ok" button. This opens a DOS prompt. 2.Type "arp" in the command prompt. This gives you a list of options to use with the arp command. 3.Type "arp -a" in the command prompt. This lists a number of MAC addresses with the associated IP addresses. Since you have the MAC address, scroll down the list to  find the associated IP address. The MAC address is shown in the "Physical Address" column with the IP address in the "Internet Address" column. Else if you want to find the network ip address then have a look at sites like Ip-Details.com .