Linux – Resolving MAC Address from IP Address

bashlinuxmac address

I need to write a bash script wherein I have to create a file which holds the details of IP Addresses of the hosts and their mapping with corresponding MAC Addresses.

Is there any possible way with which I can find out the MAC address of any (remote) host when IP address of the host is available?

Best Answer

If you just want to find out the MAC address of a given IP address you can use the command arp to look it up, once you've pinged the system 1 time.

Example

$ ping skinner -c 1
PING skinner.bubba.net (192.168.1.3) 56(84) bytes of data.
64 bytes from skinner.bubba.net (192.168.1.3): icmp_seq=1 ttl=64 time=3.09 ms

--- skinner.bubba.net ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 3.097/3.097/3.097/0.000 ms

Now look up in the ARP table:

$ arp -a
skinner.bubba.net (192.168.1.3) at 00:19:d1:e8:4c:95 [ether] on wlp3s0

fing

If you want to sweep the entire LAN for MAC addresses you can use the command line tool fing to do so. It's typically not installed so you'll have to go download it and install it manually.

$ sudo fing 10.9.8.0/24

fing example

Using ip

If you find you don't have the arp or fing commands available, you could use iproute2's command ip neigh to see your system's ARP table instead:

$ ip neigh
192.168.1.61 dev eth0 lladdr b8:27:eb:87:74:11 REACHABLE
192.168.1.70 dev eth0 lladdr 30:b5:c2:3d:6c:37 STALE
192.168.1.95 dev eth0 lladdr f0:18:98:1d:26:e2 REACHABLE
192.168.1.2 dev eth0 lladdr 14:cc:20:d4:56:2a STALE
192.168.1.10 dev eth0 lladdr 00:22:15:91:c1:2d REACHABLE

References

Equivalent of iwlist to see who is around?

Related Solutions

How to use shell to derive an IPv6 address from a MAC address

If you want to create a whole IPv6 address from a MAC (and a given prefix), you could use the excellent ipv6calc tool by Peter Bieringer.

The following command creates a link-local IPv6 address (fe80:: prefix) from a MAC address:

$ ipv6calc --action prefixmac2ipv6 --in prefix+mac --out ipv6addr fe80:: 00:21:5b:f7:25:1b
fe80::221:5bff:fef7:251b

You can leave most of the options away and let the command guess what to do:

$ ipv6calc --in prefix+mac fe80:: 00:21:5b:f7:25:1b
No action type specified, try autodetection...found type: prefixmac2ipv6
fe80::221:5bff:fef7:251b

For Debian distros, ipv6calc is in the main repository.

Bash – Create map network_iface_name <--> IPv4 address

Use the "-o" option of ip:

ip  -o addr  | sed -e 's/^[0-9]: \([^ ]*\).*inet \([^ \t]*\).*/\1: "\2"/;t;s/^[0-9]*: \([^ :]*\).*/\1: ""/g' | sort -r | sort -u -t: -k1,1

Output should be then in your case:

br-priv: "" 
eth0: "192.168.1.123/24"
lo: "127.0.0.1/8"
wlan0: "10.42.0.10/24"

The command prints only one IPv4 per network device (it is possible to configure multiple IP addresses at the same interface).

Explanations:

The sed expression

s/^[0-9]: \([^ ]*\).*inet \([^ \t]*\).*/\1: "\2"/;

replaces 1: lo inet 127.0.0.1/8 brd 255 [...] with lo: "127.0.0.1/8"

t;

jump to end if this could be done (=an IPv4 address was found), otherwise:

s/^[0-9]*: \([^ :]*\).*/\1: ""/

replace lines without IPv4-addresses e.g. 1: lo inet6 ::1/128 [...] with lo: "".

All lines are automatically printed out (no -n flag).

The command sort -r sorts now the line reverse. The lines with IPv4-addresses (e.g. lo: "127.0.0.1/8") are then in all cases before the lines without (lo: "").

The command sort -u -t: -k1,1 applies unique sorting to the first field (the interface names, separator is set to :). In our example only the "lo: "127.0.0.1/8" line survive as it comes first (due to the previous sorting).