Originally posted here by cgkanchi
Couldn't you ping them, capture packets and then look at the source MAC address in the packets that come in (echo reply packets)?
No this won't work. The MAC address of all the PING replies will be the MAC of the local gateway for his subnet. The only way to find out MAC addresses on another network is if your have access to a switch/router on that network.