Mac-Adddress to IP address Arp???

Does any one know of a way to find the IP address of a computer when all I have is the Mac-Address.

I thought there was an inverse arp command but I cant seem to get that working

thanks
kdog3445Asked:
Who is Participating?
 
pseudocyberCommented:
On a Cisco layer 3 box ...

rtr#show ip arp ?
  GE-WAN               GigabitEthernetWAN IEEE 802.3z
  GigabitEthernet      GigabitEthernet IEEE 802.3z
  H.H.H                48-bit hardware address of ARP entry
  Hostname or A.B.C.D  IP address or hostname of ARP entry
  Null                 Null interface
  Vlan                 Catalyst Vlans
  summary              IP ARP table summary
  |                    Output modifiers
  <cr>
0
 
JFrederick29Commented:
No, there isn't unfortunately, not one I could find anyway.

Do you have a router where you can view the ARP cache?  If you can, you should see the MAC address in the routers ARP cache along with the corresponding IP address, as long as the PC is on the network.
0
 
pseudocyberCommented:
kdog3445 - what kind of network do you have?  Managed or not?  Pro gear or Small Office/Home Office (SOHO) gear?  Switched or hub?

If you're in a hub environment, you could do a sniff for a while of your network and then look for that MAC and look at the associated IP.

Ideally, you would view the ARP table in the default gateway router for the segment.
0
Protect Your Employees from Wi-Fi Threats

As Wi-Fi growth and popularity continues to climb, not everyone understands the risks that come with connecting to public Wi-Fi or even offering Wi-Fi to employees, visitors and guests. Download the resource kit to make sure your safe wherever business takes you!

 
DVation191Commented:
Well, I know what you are talking about is RARP ( Reverse Address Resolution Protocol ), but unless you have access to the router (enterprise-grade), looking at the tables won't be possible. Maybe another expert can shine some more light on the situation
0
 
lrmooreCommented:
Is this system on your own local LAN? If not-- fuggedaboutit.
If it is on your own local LAN, in the same subnet, try a broadcast ping:
ping 192.168.1.255

All live hosts should respond, then use "arp -a" from Command line:
C:\WINDOWS>ping 192.168.12.255

Pinging 192.168.12.255 with 32 bytes of data:

Reply from 192.168.12.253: bytes=32 time<1ms TTL=255
Reply from 192.168.12.132: bytes=32 time<1ms TTL=64
Reply from 192.168.12.132: bytes=32 time<1ms TTL=64
Reply from 192.168.12.132: bytes=32 time<1ms TTL=64

Ping statistics for 192.168.122.255:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

C:\WINDOWS>arp -a

Interface: 192.168.122.150 --- 0x2
  Internet Address      Physical Address      Type
  192.168.122.132       00-0c-41-d6-1e-5b     dynamic
  192.168.122.149       00-07-95-24-74-4f     dynamic
  192.168.122.157       00-0c-41-a9-3d-51     dynamic

C:\WINDOWS>

If it's not in the same subnet, but still on the local LAN, then you might have to resort to using a sniffer like Ethereal:
http://www.ethereal.com



0
 
JFrederick29Commented:
Excellent lrmoore!

I bow to you...
0
 
kdog3445Author Commented:
It is a LAN and I do have acess to the Router. What is the command to view the Arp table?

I do sh Mac-address and it list all connected MAC's but does not list IP address. What command am I missing?

Thanks
0
 
pseudocyberCommented:
What kind of router?

You want to look at the ARP table, not the MAC forwarding table (assuming this is a layer 3 switch).

It's probably something along the lines of "show ip arp"  or "show arp"
0
 
kdog3445Author Commented:
It is a cisco and I am doing
rtr#show ip arp ?
  GE-WAN               GigabitEthernetWAN IEEE 802.3z
  GigabitEthernet      GigabitEthernet IEEE 802.3z
  H.H.H                48-bit hardware address of ARP entry
  Hostname or A.B.C.D  IP address or hostname of ARP entry
  Null                 Null interface
  Vlan                 Catalyst Vlans
  summary              IP ARP table summary
  |                    Output modifiers
  <cr>

I put in the Mac address after sh IP arp

but nothing gets displayed
0
 
pseudocyberCommented:
What do you get if you do a show ip arp?

The machine has to be on segments connected to the router.  It could also be the machine is off and has aged out of the arp table.
0
 
kdog3445Author Commented:
Ahhhhh Haaaaaa

User Error

I was running all this from a switch and not the core router

so from the switch I run
sh mac-address int fast 5/3   and get the MAC

Then from the router I run

sh ip arp 00-00-00-00-00-00
that get me the IP

SWEET -- thanks all
0
 
pseudocyberCommented:
You're welcome! :)
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.