1

I think there is an IoT device on my network that has lost its IP address or IP address has been corrupted by a power surge. I want to scan MAC address to see if it is still 'hiding' on my network. I have another device from the same manufacturer, so I can limit the scan to 16 million instead of the 200+ trillion that a scan of every address would require. What would be better would be if there was a MAC address 'all-call' that could be used to tell every device to answer-up. I need to make sure that whatever gets used does not leave my local network.

2
  • You'd need to tell us more, like the make and model of your switch. – Jesse P. Jul 3 '19 at 0:58
  • Home networks are off-topic here; please ask on Super User – Mike Pennington Jul 8 '19 at 18:35
4

You cannot "scan" for MAC addresses. Depending on your environment, you can access the switching infrastructure and use commands to display the MAC Address table. The MAC address table is a table the switch uses to map MAC entries to specific ports. By looking at this table you will be displayed every MAC on the layer-2 domain and what port it's being seen on.

Different environments are more/less complex then others. This all depends on the number of VLANs, Layer 3 separation between them, and many other factors.

Here is an example command for a Cisco switch:

show mac address-table 

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
   1    0000.5e00.0101    DYNAMIC     Gi1/0/47
  12    0004.4b72.9f95    DYNAMIC     Gi1/0/23
 100    0009.b04a.2656    DYNAMIC     Gi1/0/40
 000    000c.290b.e306    DYNAMIC     Gi1/0/6
1
  • Unfortunately, all I have is a Linksys E8350 (combined access point, switch, and router), only command interface a limited GUI, no CLI. – SkyWsie Jul 4 '19 at 14:52
4

With an on-topic switch, you can look up the address in its MAC table either on the web interface or the console interface. The console command is something like show mac address-table (Cisco) or show mac-address (various others).

Wireless access points usually have a table showing connected devices (and possibly remembered, disconnected ones) by MAC address.

Another approach would be to run a packet trace on the supposed switch/router port and filter out known MAC addresses. Possibly the device is even broadcasting (ARPing its default gateway for instance), so you could capture those broadcasts anywhere in the network.

Other than that there's no way to "scan" for MAC addresses.

2
  • Unfortunately, all I have is a Linksys E8350 (combined access point, switch, and router), only command interface a limited GUI, no CLI. – SkyWsie Jul 4 '19 at 14:51
  • @SkyWsie Sorry, but consumer-grade hardware is explicitly off-topic here. – Zac67 Jul 4 '19 at 14:52
0

In your particular situation, network reconnaissance tools like packet sniffers might be better suited to locate a device on the network. Keeping in mind that MAC Addresses are layer-2 and unencrypted.

1
  • Removed off-topic product/resolurce recommendations. – Ron Maupin Jul 7 '19 at 22:27
0

Previous suggestion are great, one more best command in cisco switches are Traceroute Mac address. The show mac address table , Will show the next port from where the mac has learned not the originating port.

Traceroute will show the originating Switch / Port.

traceroute mac "mac.you.look" "mac.you.look"

Regards, Hazif

Not the answer you're looking for? Browse other questions tagged or ask your own question.