Bob Miller wrote:
> Cory Petkovsek wrote:
>
> > How can I find the ip address given a mac address on a lan. The machine
> > has not connected to me.
>
> First, remember the mapping from MAC address to IP address is one to
> many, not one to one.
>
> Second, your best bet is to sniff packets going to/from that MAC
> address. Something like this. There isn't a protocol, AFAIK, that
> functions as reverse ARP in the general case. (Sun's RARP is only
> used during diskless boot.)
>
> tcpdump -i $if -e ether host 0:d0:59:18:2:c2
>
> (The "-e" flag dumps the ethernet header.)
>
> Third, you can look in /usr/share/ethereal/manuf for the
> manufacturer's prefix. The one you list, 00:D0:59, belongs to Ambit
> Microsystems.
If you know that the IP address is in some range (like on a single
subnet), you can ping every IP address in that range and check the
kernel's ARP table.
Like this.
nmap -sP 192.168.2.0/24
arp -an | grep -i 00:04:5a:93:96:0b
--
Bob Miller K<bob>
kbobsoft software consulting
http://kbobsoft.com [EMAIL PROTECTED]
_______________________________________________
Eug-LUG mailing list
[EMAIL PROTECTED]
http://mailman.efn.org/cgi-bin/listinfo/eug-lug
