Get hostname from MAC address on Windows

If you start with a MAC address, you first need to get the IP address. This means that you need access to a device that has the IP address associated with the MAC. As per the question, arp -a will list the MAC addresses and corresponding IP addresses. In order to populate that list, the machine will have had to at some point issued an arp request, saying "who has IP x.x.x.x" - the owner will reply and upon receipt, the arp table will be populated.

In order for this to work, both devices must be on the same layer 2 network - the same switch/vlan. You can trigger arp requests manually by pinging every IP on the network, or using a utility like nmap to do them all in one go.

Once you have the IP address, you are relying on a name resolution service to do a reverse lookup and return a hostname that is associated with an IP.

In DNS this is achieved through PTR records. For each IP address, there is a PTR record in which is stored the associated hostname. However, there is no obligation to store PTR records so they may not be present, in which case the lookup will fail.

They look like this:

13.12.11.10.in-addr.arpa. 900   IN      PTR     hostname.domain.com.

The IP address in the PTR record is reversed. So to get the hostname of 10.11.12.13, we say to DNS "Give me the PTR record for 13.12.11.10.in-addr.arpa."

It returns the above record. You can achieve this in by doing

nslookup 10.11.12.13

When nslookup is given an IP address, it will try to do a PTR lookup.

As per the other reply, if the IP belongs to a Windows machine, you can also do nbtstat -A 10.31.46.59 (note the uppercase -A)

Ping -a <ip address>

This will parse your reverse lookup zone in DNS.

If you don't have a reverse lookup zone it will lookup in your local name cache.

If you don't have an entry it will do a broadcast on your LAN (within the subnet you are in) to query for it.

This only for IP > hostname resolution. No MACs.