ch12345:
I think standard arp command cannot do this. Am I wrong?
....Armin
Main Topics
Browse All TopicsIs there a tool out there, that gives me the ip-address or the computername with given MAC-address??
thanks
witty
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Seems there isn't such a tool avaliable. So we'll have to write one.
I think that automating witty's approach using some simple batch program loops would do the trick (though running through all the adresses will take a few minutes).
I'd be happy to write and post such a "tool", but of course I'd like you to confirm that this is an acceptable solution for you, before I spend the time to do it.
....Armin
The outcome is limited to machines with Microsoft OS or compatible on it. No print boxes, no routers, switches, ect. And you still get only one adress at a time.
Of yourse, if I make a batch loop solution I can use the same routine to trigger and filter NBTSTAT, with no difference (except the above limitation).
And I doubt nbtstat -a is faster than ping (though this needs to be tested).
"To batch or not to batch", still the major question.
Armin
Your wish is my command.
@if [%debug%]==[] Echo off
cls
echo --------------------------
echo MAC discovery tool V1.0 (C) 2000 Armin Linder
echo --------------------------
If [%1]==[] goto Help
If [%1]==[/?] goto Help
REM parse the starting IP adress in %1
for /F "tokens=1,2,3,4 delims=." %%w in ('echo %1') do call :intoenv %%w %%x %%y %%z SW SX SY SZ
Echo Starting Adress: %SW%.%SX%.%SY%.%SZ%
Set EI=%2
If [%EI%]==[] Set EI=%1
Echo Ending Adress: %EI%
Echo.
Set CW=%SW%
Set CX=%SX%
Set CY=%SY%
Set CZ=%SZ%
If NOT [%CZ%]==[0] Echo %Time%: %CW%.%CX%.%CY%.%CZ% ...
:loop
Set CI=%CW%.%CX%.%CY%.%CZ%
If [%CZ%]==[0] Echo %Time%: %CI% ...
Ping -n 1 %CI% -w 100 >nul
For /F "tokens=1,2 skip=3" %%i in ('arp -a %CI%') do Call :HostInfo %%i %%j
if [%CI%]==[%EI%] goto loopend
If [%CZ%]==[255] (Set CZ=0) Else (Set /A CZ=CZ+1 & Goto loop)
If [%CY%]==[255] (Set CY=0) Else (Set /A CY=CY+1 & Goto loop)
If [%CX%]==[255] (Set CX=0) Else (Set /A CX=CX+1 & Goto loop)
If [%CW%]==[255] (goto loopend) Else (Set /A CW=CW+1 & Goto loop)
goto loop
:loopend
goto end
:IncZ
Set %1=0
Set /A %2=%2+1
Goto :EOF
:HostInfo
If [%2]==[00-00-00-00-00-00] Goto EndHostInfo
Echo IP: %1 MAC: %2
:EndHostInfo
Goto :EOF
:IntoEnv
Set %5=%1
Set %6=%2
Set %7=%3
Set %8=%4
Goto :EOF
:help
echo Usage: scanmac starting-ip [ending-ip]
echo.
echo will list IP and MAC adresses of all active computers
echo within a physical network segment.
echo.
echo if ending-ip is omitted, ending-ip = starting-ip
echo.
Pause
goto end
:end
Tool is currently scanning my office net (8 C-class IP subnets on physical ethernet, 2 currently populated). Running smoothly so far. Will post screenshot of results in approx 15 minutes for completeness. Currently on subnet 5 of 8.
command line has been:
scanmac 192.168.8.1 192.168.15.254
Known issues:
* cannot detect scanning computer's own MAC address (guess why :-))
* can scan all IP subnets on physical ethernet if you set default gateway of scanning machine to own IP address (undocumented Microsoft? IP stack feature, but sometimes convenient)
* does not exclude invalid host adresses (0 and 255), scanning them doesn't do any harm.
* easy to change to use nbtstat instead of arp. Trade "physical subnet" and "cannot detect own adress" limitation against "NETBIOS boxes only" limitation -- your choice.
* ping is configured to wait only 100 msec for response, to keep scanning time of empty subnets low, and send just one single ping packet. May lead to missing MACs on heavily loaded segments. Customize ping parameters if necessary.
* included some tactically well choosen echos so you can see scanning progress.
* output may redirected to file for further processing.
* pure batch, tested on Windows 2000 box. Should work with NT4 right away (except time-stamp). Testing with NT4 box in progress.
Oops, W2000 test just completed successfully. Took me a while to write this comment. Tool scanned 8 nets (2048 adresses), took 15 minutes to complete. See results in next message.
....Armin
Finished task on NT4 box perfectly, except time-stamp, NT4 does not yet support %Time%.
Results on Windows 2000 box:
--------------------------
MAC discovery tool V1.0 (C) 2000 Armin Linder
--------------------------
Starting Adress: 192.168.8.1
Ending Adress: 192.168.15.254
21:39:09.19: 192.168.8.1 ...
21:41:17.49: 192.168.9.0 ...
IP: 192.168.9.1 MAC: 00-50-da-11-89-62
IP: 192.168.9.2 MAC: 00-50-da-11-8a-6f
IP: 192.168.9.3 MAC: 00-01-02-1b-a0-a1
IP: 192.168.9.4 MAC: 00-50-da-11-8a-90
IP: 192.168.9.5 MAC: 00-01-02-1b-9f-78
IP: 192.168.9.6 MAC: 00-01-02-1b-a1-bc
IP: 192.168.9.8 MAC: 00-50-da-11-8a-7a
21:43:22.16: 192.168.10.0 ...
21:45:30.86: 192.168.11.0 ...
21:47:39.04: 192.168.12.0 ...
21:49:47.23: 192.168.13.0 ...
21:51:55.41: 192.168.14.0 ...
21:54:03.59: 192.168.15.0 ...
IP: 192.168.15.1 MAC: 00-a0-24-f1-31-be
IP: 192.168.15.10 MAC: 00-50-04-19-e6-4d
IP: 192.168.15.11 MAC: 00-50-da-56-19-d8
C:\>
Got the malfunctioning batch from witty and looked into it.
The problem is that Experts Exchange when copying the batch from the browser seems to append a trailing blank to all lines, which invalidates some string comparisions.
Either remove all the trailing blanks, or send me an e-mail to get the "clean" version.
....Armin
Tim
it's never the points that are my main reason to contribute in Experts Exchange, but finding solutions to problems. Getting some points every now and then is convenient because I can use them to post own questions that has very often saved me hours after hours looking in books for answers others probably already have at hand.
I have been thinking a while ago about how to achieve this MAC infos myself, but never took the time to sit down and go into the details.
Actually I have started writing the program about 3 hours before witty agreed to a batch file scanning all adresses, since that's not exactly what we all have been seeking for because of the obvious performance problem on large subnets.
So my primary reward is having the program, not the points.
And yes, I am insane, that's exactly what my girlfirnd says to me when I return from the office well after midnight as well. Insane, maybe, but happy with it. :-)
....Armin
Well do you really want to know what I want it for?
OK:
We use good(?), old Token-Ring!
Switches are from Madge (CAU & LAM).
The software shipped with the switches looks fine, but we often have beaconings on the LAN, what the software and the CAU don't recognize!
The only way how I can find out, that there are beaconings and between which NICs this occurs is our AS/400.
The Network-Management tools of the AS/400 tell me the MAC-Address of the adapter, that produces the errors in the LAN!
And this script will do the rest!
In the past, I had to click on every connection in the software of the switch to find out the MAC, but this is very boring;-) doing this on 500 connections!
I hope I explained clearly!
witty
Business Accounts
Answer for Membership
by: ch12345Posted on 2000-08-18 at 05:30:05ID: 3978753
What happened to ARP command?