If the machine has gotten an IP address from your dhcp server you could find it in: cat /var/state/dhcp/dhcpd.leases but if it hasnt tried to conect to you, you would have to scan for it. this might be a good start... http://www.google.com/search?q=scan,%20mac%20address
You might throw in nmap as another parameter... p0f, snort also look worth playing with... Jamie On Monday 30 December 2002 04:17 pm, Cory Petkovsek wrote: : How can I find the ip address given a mac address on a lan. The machine : has not connected to me. When using tcpdump, I often see an arp : request: : arp who-has 10.0.0.20 tell 10.0.0.1 : arp reply 10.0.0.20 is-at 0:d0:59:18:2:c2 : : How can I go the other way? I'm looking for something like: : $arp 0:d0:59:18:2:c2 : 0:d0:59:18:2:c2 is at 10.0.0.20 : : If that's not possible, what other methods can I use to determine which : machine has a given address? : : I suppose I can do an nmap -sP 10.0.0.0/24 and then check my arp table, : but I have a lot of "(incomplete)" references. : : Thanks, : Cory : _______________________________________________ : Eug-LUG mailing list : [EMAIL PROTECTED] : http://mailman.efn.org/cgi-bin/listinfo/eug-lug -- No microsoft products were used to produce this message. EUG-LUG Mailing List: http://mailman.efn.org/cgi-bin/listinfo/eug-lug _______________________________________________ Eug-LUG mailing list [EMAIL PROTECTED] http://mailman.efn.org/cgi-bin/listinfo/eug-lug
