Given a PC's MAC address, can I find its IP?
Is there a way to get the IP address when all you have is the MAC of an item?
If you are connected to the same broadcast domain, you can do arp -a
which will show you the ARP cache. From here you can match the MAC to IP.
If the target device and your *nix box are on the same IP subnet (and I specifically mean a true IP subnet, not the same switch, or same VLAN, or even the same broadcast domain, or anything else that is sometimes referred to as a "subnet" in layman's terms), and if they have had occasion to talk to talk to each other already, then the target device's IP -> MAC mapping is probably already in your Unix box's ARP table. You can do arp -a
to see the table.
If they're on the same subnet but haven't talked to each other yet, you can usually force it by pinging either the all-hosts multicast address (224.0.0.1) or the subnet broadcast address.
If you're not on the same IP subnet but you're on the same multicast/broadcast domain, you might be able to get its IP address by running a sniffer and watching for multicasts or broadcasts from the target MAC address:
sudo tcpdump -nei $INTERFACE ether host $MAC
...where $INTERFACE is the interface you want to listen on (maybe "en0" or "eth0" or something like that) and $MAC is the MAC address you're looking for.
To trigger the target device to send multicasts or broadcasts while you're watching with the sniffer, you can do things like ping the addresses I mentioned above, or power-cycle the target device, or unplug the device from the switch (or power-cycle the switch). Most devices are more likely to send broadcasts and multicasts at boot, or when their network link comes up after being down for a while.
Yes, it's called arp (Address Resolution Protocol). If you use a program like TCP Dump or Wireshark you will see that every so often the router/network device will ask the equivelant of "Who is [IP]" then the person will respond with their mac address.
If you are using Windows you can just open up a command line and type "arp -a" to list the ARP record you have.