For the ip gurus How to get ip address if you only have the mac address

[zikkimalambo]

Here's the scenario.....

We have a couple of D-Link print servers. We can determine the mac address from the label on the underside, but we think thet we must have given them fixed ip addresses (back in the mists of time).

Is there a utility we can run (windows or DOS i'm afraid) that will return an ip address and or hostname given a mac address?

We've tried looking in DHCP, but there is no record (which is what leads us to suspect it's got a fixed ip).

We've tried looking in DNS, but can't find it there either).

Have had a look in Google, but whilst there's plenty of people asking the question, no one seems to have come up with an answer :=((

Any ideas?

[Christian McArdle]

Try arp -a if you're lucky.

Christian.

[m__murray]

Try openning a command prompt and use 'ARP -a'

You should probably try printing to the print server in question first..

M. (Not an IP Expert !)

[zikkimalambo]

Should have said, tried arp -a

It returned some interesting looking stuff on my machine on the live network, so I tried it on the mini network (1 hub, 1PC, 1 Print Server).

It returned nothing. But then there is no dns server etc, etc running on the PC at present.

My collegue was going to try running it on one of the servers (Server

2003) to see if that would yeild the info.

With regard to the suggestion from another poster to try and print to it, that would require us to know it's ip address or hostname :=((

For the record you can't reset it to factory defaults without connecting to it either :-((

[Christian McArdle]

There's usually a reset button on it that sets it to 192.168.0.1. Put it on your mini network. Set your computer to 192.168.0.100. Then attempt to telnet or web 192.168.0.1.

Christian.

[zikkimalambo]

No, that's what I meant when I said you have to connect to it. I've even had one apart before to look for jumpers to short orwhatever, but to no avail.

I did have a brilliant idea however.

Run the D-Link supplied CD (amazingly it still read after spending 5 years on my desk as a coffee cup holder :=(( ) But that won't find it either! BAH!

This has long since gone into the realms of having cost too much in man (sorry Mary) person hours, but it's gotten me mad now!

latest is my cow-orker is going to try the same procedure but with a bog standard ancient 98 machine in case it's some firewall software or something that's getting in the way.

[Simon Kelley]

arp -a simply dumps the ARP cache of the local machine. If the local machine hasn't talked to the printer recently, the printer won't be in the ARP cache.

Try a broadcast ping: something like

ping 255.255.255.255

which will get everything on the network to reply _then_ do arp -a

Cheers,

Simon.

[andy]

If you can't reset the print server to factory default then you could have a long job here if you haven't used the print servers recently.

Bit of background; the way two peices of kit on an IP network communicate at low level is using the MAC address, when you access something using it's IP address PC's, switches and routers have to get the MAC address for that device by what is termed ARPing for it. The PC and routers then store this information for each device they have communicated with recently in what is known as an ARP table. Typing ARP -a displays the contents of this table.

So what you have to do is to get the entries for these devices into the ARP table and the only way I can see of doing this is to ping every device on the sub net and then go looking in the ARP table for the MAC addresses you already know.

There is a ping sweep application that does one better and provides the IP versus MAC for you available free at

will make pinging a large network easier, I just tried it and it works.

When you have loaded it (and the WinPcap library it tells you about) you just type:

nmap.exe -sP 172.101.100.* return

but replace the 172.101.100.* with your network address range and you will be rewarded with a screen full of IP / MAC addresses.

Load the output into a text editor and search for the MAC address you want.

[zikkimalambo]

Lots of good stuff which i'm sure will come in handy. In the meantime, i've cracked it!

First thing was 4 little letters.... rtfm

Where I found the long forgotten 3 little letters ipx

Thr D-Link admin software uses this to talk to the print server. It still didn't want to work on the XP machine (though we can probably troubleshoot this later for future use). But enabling ipx on the 98 box made it find the print server.

Turned out it had an ip address so alien to our present network setup it's no wonder it didn't show up anywheres.

Memo to self - before storing things like this away, give them a factory reset!

Thanks to all for your replies.

[Rob Morley]

You could try brute force using a port scanner like

the PC IP address to 192.168.0.1, netmask 255.255.0.0, and scan the range 192.168.0.2 to 192.168.255.254. It will take a while, but if the server is responding to pings you will get a reply eventually. If the server is using a 10.0.0.0 address it might take considerably longer ...

[Spike]

would have solved your problem in ten seconds flat.

[Paul ( Skiing8 )]

I know the problem is solved but I use a couple of tools from

IPscan and lan scanner usually do the trick, it will scan an address range on a network and report back what addresses are in use, very handy

Paul

[Stephen Gower]

Again, I see this is solved now, but another trick is to set up a static ARP pair on the XP machine: arp -s and then telnet to the given ip address. You can often get to the management agent of the device using this method, and then see what IP address it thinks it has.

[Bob Eager]

I'm assuming that these have been offline for a while, so the addresses won't appear in any ARP cache.

I also assume that the addresses are going to be (probably) in the

192.168.x.x range.

Write a script that pings every address in that range. At one go per second (run two or three scripts on subranges) you'll get through the lot in a day.

Have another script doing arp -a every five minutes, appending the results to a file.

Scan that file for the MAC address....

Alternatively, ask D-link how to restore factory settings!

[Rick]

Ping the subnet broadcast address, then do arp -a

Say your IP is 192.168.0.1, and your subnet mask is 255.255.255.0, ping 192.168.0.255 (the last address in the subnet), this will normally get all hosts to respond. personal firewalls, and broken implementations of ping will upset the "normally" bit of this statement.

VLSM makes working out the broadcast harder, post your (slightly altered) actual addresses if you can't do it.

"Cain & Abel" will do this stuff for you, and a whole bucnh of other nasty stuff if thats what you are into.

Rick

[John Rumm]

I see its sorted now, but another option that often works is to hook it up to a network and run a SNMP client. That will often get you information you can't readily get at the IP level.

[Gordon Henderson]

But you need an IP address to poke SNMP commands to it...

One way which wouldn't have worked for the OP is a Unix utility called arping. It pings via MAC address. That combined with tcpdump to see whats going over the wires (and comimg back!) has worked for me in the past.

Gordon

[zikkimalambo]

Thanks once again guys for lots of good advice.

I am sure this thread will come in very handy for those who "come googleing after"

As usual this group has provided lots of great advice. Much better than that given on what might initially seem more appropriate groups.

Thanks again.