9

Is there a way to derive the IP of a device from their MAC address on a Cisco device?

Assume you are not on a local segment where ping sweeping / arp are possible, instead you are remote and there are many routers between you and the endpoint.

Additionally the arp table on the Cisco device in question does not already include this MAC address.

2 Answers 2

7

There are a couple of options.

If you are doing DHCP snooping, you should be able to find the IP address in the binding database with the following command:

show ip dhcp snooping binding 00:00:00:00:00:00

If you don't have DHCP snooping, the Cisco device is on the same subnet (or supports multip SVIs so you can add an interface on the subnet), you are on a newer IOS (12.2ish or better) with access to TCL, and the device will respond to a ping, then you can use a TCL script. You can find many examples on the internet, one of which can be found here. Once it is able to ping the device (on the same subnet), it should be in the ARP table of the Cisco device.

Generally, it would be quicker/easier to check on the L3 device for the ARP entry or the DHCP server then the second option.

Old answer (prior to question change): Strictly answering your question, no there is no way to derive an IP address of a device from the MAC address table entry.

The MAC address table is strictly speaking a L2 set of information, tying devices to an interface. At L2, there is no awareness of an IP address (as the L3 and above information is irrelevant to L2 and could just as easily be another protocol).

You would need access to the L3 device for the remote network segment where you could look up the entry in the ARP table.

3
  • Perhaps taken a bit too literally :), I've edited it to reflect the true point of the question: Can we find the IP of a MAC address remotely?
    – A L
    May 31, 2013 at 22:56
  • user1353: no, MAC addresses are only used on the layer-2 domain (LAN) and are invisible outside it. Jun 1, 2013 at 11:08
  • Hey YLearn, thanks for clarifying your answer after my edit! Very thorough response and very much appreciated!
    – A L
    Jun 3, 2013 at 15:48
3

TL;DR -- You'll have to find the MAC in someone's ARP table -- eg. the gateway router.

As YLearn originally said, you're looking for a L3 address given only a L2 address. You'll have to find something within an appropriate L3 domain to find it. If the switch doesn't have a L3 interface in the same network, then it's arp table won't show anything. If the device isn't using DHCP (and/or dhcp snooping isn't running on the switch), it won't show up in the snooping table. I would presume there's a router somewhere that's the gateway for the target device; it's arp table should show the ip-mac link.

Worst case, the mac would pin the device down to the port. You'll have to watch the traffic on that port to find any IP address(es).

3
  • yeah - spanning the port and running wireshark or tcpdump will usually help reveal what the IP address of the device connected to that port is. Usually when the device is powered on or connected, it starts ARPing and finally gives away the secret
    – knotseh
    Jun 1, 2013 at 1:51
  • Problem with spanning the port is OP is talking about a remote location and wants to do this from the Cisco device so where to span the port to? If the OP has another station, it could be as easy as doing a ping sweep and that should turn up the MAC in ARP.
    – YLearn
    Jun 1, 2013 at 2:12
  • You can dump packets without using a SPAN. (debug ip packet but USE CAREFULLY!) Bottomline, there's gotta be a router somewhere for that L3 domain somewhere, assuming it's talking to anything else.
    – Ricky
    Jun 1, 2013 at 2:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.