Mac Address and IP - TCP-IP

This is a discussion on Mac Address and IP - TCP-IP ; If I have something's MAC, is there anyway I could find the IP of that device?...

+ Reply to Thread
Results 1 to 14 of 14

Thread: Mac Address and IP

  1. Mac Address and IP

    If I have something's MAC, is there anyway I could find the IP of that
    device?

  2. Re: Mac Address and IP

    In article <5b49974e-2f8a-4e29-8652-fb1322536780@h11g2000prf.googlegroups.com>,
    Phil wrote:
    >If I have something's MAC, is there anyway I could find the IP of that
    >device?


    Maybe.

    Consider, though, for example, my mother's computer. She has
    an "always on" internet connection, but every time she reboots,
    her ISP gives her a new IP address, with a number of completely
    different IP ranges to chose from (e.g., even the first
    octet might well change.) She turns her computer off several times
    a day. So if I told you her MAC address, which IP address would
    you expect to be able to find? The one she had yesterday? The
    one she's had since she rebooted 3 minutes ago? The IP address
    she has right now while her computer is off?


  3. Re: Mac Address and IP

    On Feb 8, 10:18*am, rober...@hushmail.com (Walter Roberson) wrote:
    > In article <5b49974e-2f8a-4e29-8652-fb1322536...@h11g2000prf.googlegroups.com>,
    >
    > Phil * wrote:
    > >If I have something's MAC, is there anyway I could find the IP of that
    > >device?

    >
    > Maybe.
    >
    > Consider, though, for example, my mother's computer. She has
    > an "always on" internet connection, but every time she reboots,
    > her ISP gives her a new IP address, with a number of completely
    > different IP ranges to chose from (e.g., even the first
    > octet might well change.) She turns her computer off several times
    > a day. So if I told you her MAC address, which IP address would
    > you expect to be able to find? The one she had yesterday? The
    > one she's had since she rebooted 3 minutes ago? The IP address
    > she has right now while her computer is off?


    It's not a public IP address. I am in a domain and I see a device that
    should not be here, however, I only have the MAC. It is using a static
    IP so I can't check DHCP to get it.

  4. Re: Mac Address and IP

    Inverse Address Resolution Protocol might help:

    http://www.networksorcery.com/enp/rfc/rfc2390.txt

    Maybe it was build into windows, me don't know, me don't know about tools as
    well.

    Good luck googling for it

    Bye,
    Skybuck



  5. Re: Mac Address and IP

    Hmm I was just experimenting with Remote Desktop Connection, you have it
    enabled as well !

    Now all I need is your login name and password LOL.

    I left you a message in your logs.

    I tried to login with

    SkybuckWasHERELOL.

    Hahahahahahaha

    What you doing with windows server 2003 anyway ?

    Fun stuff lol.

    Bye,
    Skybuck =D



  6. Re: Mac Address and IP

    Me thinks you honeypotting LOL.

    Bye,
    Skybuck



  7. Re: Mac Address and IP

    On Fri, 08 Feb 2008 08:19:25 -0800, Phil wrote:

    > It's not a public IP address. I am in a domain and I see a device that
    > should not be here, however, I only have the MAC. It is using a static
    > IP so I can't check DHCP to get it.


    1) Dump the mac-address tables on the switches, see what port it is
    connected to. Then follow the cables.

    2) Do a ping sweep of your LAN, then inspect your arp tables. (On unix,
    nmap -sP /; arp -a | grep )

    M4

  8. Re: Mac Address and IP

    Phil wrote:
    >It's not a public IP address. I am in a domain and I see a device that
    >should not be here, however, I only have the MAC. It is using a static
    >IP so I can't check DHCP to get it.


    I've successfully done this by just capturing network traffic. I would
    use Wireshark with capture filter like (use your MAC):

    ether host 00:11:22:33:44:55

    Obviously you would have to be on the same subnet.

    John


  9. Re: Mac Address and IP


    "Phil" wrote in message
    news:6168849e-93a5-4633-979a-2d545b7cdc5d@s37g2000prg.googlegroups.com...
    On Feb 8, 10:18 am, rober...@hushmail.com (Walter Roberson) wrote:
    > In article
    > <5b49974e-2f8a-4e29-8652-fb1322536...@h11g2000prf.googlegroups.com>,
    >
    > Phil wrote:
    > >If I have something's MAC, is there anyway I could find the IP of that
    > >device?

    >
    > Maybe.
    >
    > Consider, though, for example, my mother's computer. She has
    > an "always on" internet connection, but every time she reboots,
    > her ISP gives her a new IP address, with a number of completely
    > different IP ranges to chose from (e.g., even the first
    > octet might well change.) She turns her computer off several times
    > a day. So if I told you her MAC address, which IP address would
    > you expect to be able to find? The one she had yesterday? The
    > one she's had since she rebooted 3 minutes ago? The IP address
    > she has right now while her computer is off?


    It's not a public IP address. I am in a domain and I see a device that
    should not be here, however, I only have the MAC. It is using a static
    IP so I can't check DHCP to get it.


    try RARP!



  10. Re: Mac Address and IP

    In article ,
    "Skybuck Flying" wrote:

    > Inverse Address Resolution Protocol might help:
    >
    > http://www.networksorcery.com/enp/rfc/rfc2390.txt
    >
    > Maybe it was build into windows, me don't know, me don't know about tools as
    > well.
    >
    > Good luck googling for it


    Inverse ARP is rarely implemented -- the only place I've ever seen it is
    on Frame Relay networks.

    --
    Barry Margolin, barmar@alum.mit.edu
    Arlington, MA
    *** PLEASE post questions in newsgroups, not directly to me ***
    *** PLEASE don't copy me on replies, I'll read them in the group ***

  11. Re: Mac Address and IP

    Somebody wrote some linux version had it !

    Bye,
    Skybuck.



  12. Re: Mac Address and IP


    "Barry Margolin" wrote in message
    news:barmar-6F8366.00040309022008@comcast.dca.giganews.com...
    > In article ,
    > "Skybuck Flying" wrote:
    >
    >> Inverse Address Resolution Protocol might help:
    >>
    >> http://www.networksorcery.com/enp/rfc/rfc2390.txt
    >>
    >> Maybe it was build into windows, me don't know, me don't know about tools
    >> as
    >> well.
    >>
    >> Good luck googling for it

    >
    > Inverse ARP is rarely implemented -- the only place I've ever seen it is
    > on Frame Relay networks.




    RARP is different from Inverse ARP (InARP).

    RARP is used to obtain an IP address for a given hardware address.
    Basically, RARP is used to obtain the Layer 3 address of the requesting
    station itself.

    In InARP the requesting station already knows its own Layer 2 and Layer 3
    addresses, and it is querying the Layer 3 address of another station. InARP
    is primarily used in Frame Relay and ATM networks, where Layer 2 addresses
    of virtual circuits are sometimes obtained from Layer 2 signalling, and the
    corresponding Layer 3 addresses must be available before these virtual
    circuits can be used.



  13. Re: Mac Address and IP

    In article , "eager"
    wrote:

    > "Barry Margolin" wrote in message
    > news:barmar-6F8366.00040309022008@comcast.dca.giganews.com...
    > > In article ,
    > > "Skybuck Flying" wrote:
    > >
    > >> Inverse Address Resolution Protocol might help:
    > >>
    > >> http://www.networksorcery.com/enp/rfc/rfc2390.txt
    > >>
    > >> Maybe it was build into windows, me don't know, me don't know about tools
    > >> as
    > >> well.
    > >>
    > >> Good luck googling for it

    > >
    > > Inverse ARP is rarely implemented -- the only place I've ever seen it is
    > > on Frame Relay networks.

    >
    >
    >
    > RARP is different from Inverse ARP (InARP).
    >
    > RARP is used to obtain an IP address for a given hardware address.
    > Basically, RARP is used to obtain the Layer 3 address of the requesting
    > station itself.


    Right. DHCP (and BOOTP before it) has pretty much replaced this.

    > In InARP the requesting station already knows its own Layer 2 and Layer 3
    > addresses, and it is querying the Layer 3 address of another station. InARP
    > is primarily used in Frame Relay and ATM networks, where Layer 2 addresses
    > of virtual circuits are sometimes obtained from Layer 2 signalling, and the
    > corresponding Layer 3 addresses must be available before these virtual
    > circuits can be used.


    That's what I was talking about.

    --
    Barry Margolin, barmar@alum.mit.edu
    Arlington, MA
    *** PLEASE post questions in newsgroups, not directly to me ***
    *** PLEASE don't copy me on replies, I'll read them in the group ***

  14. Re: Mac Address and IP


    >
    > 2) Do a ping sweep of your LAN, then inspect your arp tables. (On unix,
    > nmap -sP /; arp -a | grep )
    >
    > M4


    There is a nice tool from Colasoft (http://www.colasoft.com/
    mac_scanner/) that sends out very rapid arps on a given subnet. Is
    helpful if you have an idea in what range your mystery IP is in,
    192.168.x.y, not so much if you don't.

    Good luck,
    Dan

+ Reply to Thread