How To Identify IP From MAC Address

Sometimes you only have a MAC address to work with — how do you find and identify the device on the network?

If you are in IT, and chances are if you are reading this you are, there will come a time where you will need to reverse lookup an IP address. This process is similar to looking up a home address when you have their phone number.

There could be a number of different devices on your network that you may want to investigate – Workstations, servers, mobile devices or printers to name a few – and all you have access to is the MAC Address information.

First – What is a MAC Address in the first place?

A MAC address or Media Access Control is an address that is given to a network adapter when it is manufactured. This is a hardwired, hard-coded, burned-in or ‘tattooed’ set of data that is assigned to the NIC ( Network Interface Card ) and is unique to the device.

ARP or Address Resolution Protocol will translate the IP address into a MAC Address and act as a passport for the data through to the specified hardware. This is a perfect example of how software and hardware work together to accomplish the goal.

Going back to MAC Addresses – you may notice that the MAC address and the IP address look nothing alike. An IP could be 192.168.0.1 while a MAC may look like 00:50:56:C0:00:01

The first three octets are generally used as identifiers by many brands and it is not uncommon for each of these manufacturers to have more than 1 set of OUI’s ( Organizationally Unique Identifier ).

Dell: 00-14-22
Nortel: 00-04-DC
Cisco: 00-40-96
Belkin: 00-30-BD

A few well known Manufacturer OUI’s

Okay – Enough background – How do we find the IP of a device on the network when we only have the MAC Address?

Option 1 – Check DHCP Server

If you have access to the DHCP server running on the network this may be the quickest and easiest way to find this information. Because most networks utilize DHCP, this is the central location that would contain the IP, Hostname and associated MAC Address of the device.

From the server’s desktop, navigate to DHCP console then expand out the selections to display the current Address Leases. Under Unique ID will be listed the MAC Address of the device.

If you are using a home grade router/firewall you will need to identify where DHCP is running and then navigate to that section.

Option 2 – ARP Request

Yet again – ARP comes through to help. Once connected to the network and a ping of the broadcast is complete ( example: if your on a 192.168.1.X network with a mask of 255.255.255.0 you would ping 192.168.1.255 to reach the broadcast IP.

This response will fail for all 4 packets but once the ping is complete, send an arp -a command to display all the connected devices on your network which will also include their MAC Address.

• About
• Latest Posts

David

I have been in the Information Technology industry for a little over a decade gaining a Bachelors degree in Information System Security and securing employment with various industries including Government, Financial, Healthcare, Corporate and the End User sectors.
I started Your Digital Mind in 2016as a way to share my love for Education, Technology and Science in an entertaining yet rewarding format. I hope you are learning and enjoying!

Latest posts by David (see all)

• iOS 16.4.1— Urgent Update Recommended - April 10, 2023
• SAML – What The Heck Is Security Assertion Markup Language? - April 6, 2023
• Employees Sharing Sensitive Business Data with ChatGPT Raises Security Concerns - March 30, 2023