Results 1 to 7 of 7

Thread: Finding a MAC address

  1. #1
    Join Date
    Jan 2002

    Finding a MAC address

    I am trying to find what is on the other end of a couple of wildly run CAT5 cables. They are plugged into a CISCO 4006 and instead of just unplugging them and waiting to hear who complains. I wanted to know if anyone could help me. From within the a terminal session I could get the MAC address of what is on the other end but does anyone know of a way that I could relate that to an ip address. Is there some sort of reverse arp lookup command or program?

    Thanks in advance....

  2. #2
    Junior Member
    Join Date
    Aug 2002
    Gixxer, you can look up who the mac address was issued to here
    or a million other places
    as to working out an ip address ??? not sure sorry

  3. #3
    Senior Member
    Join Date
    Nov 2001
    display the routers arp table:

    show arp
    Bukhari:V3B48N826 “The Prophet said, ‘Isn’t the witness of a woman equal to half of that of a man?’ The women said, ‘Yes.’ He said, ‘This is because of the deficiency of a woman’s mind.’”

  4. #4
    Jaded Network Admin nebulus200's Avatar
    Join Date
    Jun 2002
    If you have a machine plugged into the same network as the devices in question (for the sake of demonstration say you are on a subnetted 192.168.10 net with a /24 netmask)

    (This may or may not work depending on your setup)

    ping (ping your broadcast)

    This should make every computer on your network respond with a echo reply.

    Then type: arp -a (depends on OS, but will need a unix or a Win NT/2k/XP) to print your arp table, look for the MAC address, it should have its IP pairing...I am assuming from that point you would be able to figure itt out...


    PS Potential problem: They have a personal firewall and/or block replies to pings, in which case, you will have to use a few other arp style games, but I think this will be enough to point you in the right direction.
    There is only one constant, one universal, it is the only real truth: causality. Action. Reaction. Cause and effect...There is no escape from it, we are forever slaves to it. Our only hope, our only peace is to understand it, to understand the 'why'. 'Why' is what separates us from them, you from me. 'Why' is the only real social power, without it you are powerless.

    (Merovingian - Matrix Reloaded)

  5. #5
    AO übergeek phishphreek's Avatar
    Join Date
    Jan 2002
    If you are on a Windows, you can use nbtstat

    I use nbtstat -a 192.168.0.x

    change the address to fit your network ip scheme.

    NetBIOS Remote Machine Name Table

    Name Type Status
    W-262-05 <00> UNIQUE Registered
    WORKGROUP <00> GROUP Registered
    W-262-05 <03> UNIQUE Registered
    W-262-05 <20> UNIQUE Registered
    WORKGROUP <1E> GROUP Registered

    MAC Address = 00-10-5A-E7-C5-2C
    Quitmzilla is a firefox extension that gives you stats on how long you have quit smoking, how much money you\'ve saved, how much you haven\'t smoked and recent milestones. Very helpful for people who quit smoking and used to smoke at their computers... Helps out with the urges.

  6. #6
    AntiOnline Senior Medicine Man
    Join Date
    Nov 2001
    just to elaborate on tedobs post

    Log into the router, run

    s arp (if you have the IP). That will display the arp table...

    IP Address MAC Address Type Age Port
    1 0010.e005.0360 Dynamic 8 12

    Reverse arp only works if you already know the MAC. It gives you all the Ip's associated with that mac.

    s arp ma 0010.e005.0360

    IP Address MAC Address Type Age Port
    1 0010.e005.0360 Dynamic 0 1
    2 0010.e005.0360 Dynamic 0 1
    It is better to be HATED for who you are, than LOVED for who you are NOT.

    THC/IP Version 4.2

  7. #7
    Join Date
    Jan 2002
    Thanks guys. I jumped into the gateway router and did a "show arp". That seemed to work for most of the mac's that I needed to lookup. However, some of the mac addresses did not appear in the gateways table. For example, one unmarked line goes into the Catalyst 4006 on port 20. From within the 4006, I did a "show cam dynamic 5/20". This came back with two mac addresses that are assosiated with it. Neither of them are in our gateway's arp table. Can anyone explain?

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts