Is there a way to find out a computer's MAC address if we know its IP address, assuming this computer is outside our LAN? I know we can easily get the physical address of a computer in our LAN using getmac or arp in command prompt, but these commands don't work for other remote hosts.
-
Not without wrapping it in some higher-layer protocol, I'm afraid. There might be some software that does this, but I do not know if it is encouraged. May I ask for the specific use-case?– HexaholicJan 3, 2016 at 21:12
-
@Hexaholic, recently I got interested in network monitoring over the command line, so after reading a post about whether it's possible to find the IP of a MAC address, I wondered if we could do it the other way around. Here's the link to the question: networkengineering.stackexchange.com/questions/1491/…– a_krisJan 4, 2016 at 11:23
-
If you have access to the DHCP server that services the remote LAN, you could check the DHCP leases and match up the IP address to the MAC address that way.– KeyszerSJan 4, 2016 at 20:29
3 Answers
Getting a MAC address requires the ability to get broadcast traffic.
ARP is a broadcast protocol and is therefore only available on a LAN.
Once traffic is routed you are unable to get the MAC address as it is stripped from the packet once it crosses the boundary of a router/L3 device.
Switches have a MAC table. Routers have a routing table, in general.
You can only get MAC addresses from a LAN.
-
1Routers with multiaccess LAN interfaces also have MAC tables - it is the interface that determines if you have a MAC table, not the role of your device (routers still have to forward at L2, so they still need to know where stations reside). Also, MACs are not stripped by L3 devices as a rule - they are stripped by devices that do media translation (e.g. from ethernet to SONET, etc.). A router may change a MAC address, but if the L1 medium requires one, the header will of course still be present (and contain a valid value). Jan 4, 2016 at 5:19
No. MAC addresses only have significance on a LAN. Different LAN types have difference kinds of MAC addresses. Knowing the MAC address of a host on a different LAN is meaningless.
-
1Also, many IPs can share the same MAC, so it's not useful for a one-to-one map.– pppJan 4, 2016 at 4:39
Using the DHCP server or known bindings you can find it, I have done this in Windows server before, it is not common but it is possible. ARP is locally based and just a binding between an IP and MAC address tying them together to facilitate traffic flow past the boundaries of layer 3 network boundaries.....This is where routers come in. MAC addresses are only important getting the frame/packet to the router, at that point it is then forwarded again based on the MAC/IP combination.
ANgry IP scanner would tell you, and you could locally perform an arp -a...routers use this to map MAC addresses when they are not known at a layer three boundary in order to assist with route forwarding for packets. this information is then stored in the arp cache of the device.MAC addresses exist per LAN, routers connect LAN boundaries at layer 3, hence tying the two together.