Easiest way to find MAC address of a device
We have installed a bunch of medical devices to a location and now we need to activate their network function. Device has an embedded OS (unknown) and only shows its IP address on its network menu once connected to a network.
On this location I have to provide MAC addresses of the devices in order to join them to the network. Manufacturer says only way to see the MAC address is to connect it to network and use ARP command or check through the network.
What would be the fastest way to see the MAC address of this device without connecting it to the network on this location?
I am considering getting a ethernet enabled mobile modem to resolve this but if there is an easier way it would be very helpful.
ARP is your friend. Every device (even without an IP) is sending ARP broadcasts. Your device will save these in an ARP table.
Connect a Windows or Linux device via Ethernet to the device and run
arp -a
in the terminal/cmd. This lists all the devices, with their respective MAC-Adresses
You can connect the device with just one cable directly to your windows/linux workstation
Links:
- https://www.networkworld.com/article/2750342/checking-your-arp-entries.html
Do I understand it correctly: in order to get the device into the network you need it’s MAC-address, and in order to get the MAC-address it needs to be in a network, right? So the only option I can come up with is to use a different network to the one you want to put it into, like your phone’s mobile hotspot. Connect the device to your phone or any other WiFi broadcasting device, many laptops can do that as well, get the information you need and then configure the primary network to allow the now known MAC-address.
Start up a linux box, and plug it and your mystery machine back to back with ethernet. (You can also connect them through a small switch, but the switch should not be connected to the rest of your network). Then run the command ip link show
mint@mint:~$ ip link show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: enp63s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000
link/ether 78:ac:c0:95:99:02 brd ff:ff:ff:ff:ff:ff
This shows two interfaces: lo (localhost interface 'lo' which should be ignored), and the ethernet interface -- in this case enp63s0. If you are on a laptop you are also likely to see a wireless interface, often starting it's name with a name with a 'wl'
The next line starts up tcpdump to listen for arp or bootp (DHCP) packets. sudo tcpdump -i enp63s0 arp or port bootps (with enp63s0 being replaced with the ethernet port name you got from the 'ip' output)
mint@mint:~$ sudo tcpdump -i enp63s0 arp or port bootps
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on enp63s0, link-type EN10MB (Ethernet), capture size 262144 bytes
00:44:52.975293 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 78:ac:c0:95:99:02 (oui Unknown), length 282
00:44:54.008963 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:15:b7:9c:12:e9 (oui Unknown), length 282
00:45:09.351543 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 78:ac:c0:95:99:02 (oui Unknown), length 282
00:45:10.071609 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:15:b7:9c:12:e9 (oui Unknown), length 282
^C
4 packets captured
4 packets received by filter
0 packets dropped by kernel
mint@mint:~$
Notice that you see requests from two different addresses. One is the same as you see on the interface you're listening on (in this case, wlp63s0 = 78:ac:c0:95:99:02 ) the other is the address you're looking for (in this case, 00:15:b7:9c:12:e9) Once you have the MAC address, you can just unplug this machine and plug in the next machine you want the address of..
Your linux machine does not need to be a dedicated box. This was tested using a machine booted from a live DVD (linux mint 20.3 )