checking if a MAC address exist in a LAN and which is the attached IP address

Hello,

I have a certain client which I know it's MAC address ; the IP
of the client is cahnged from time to time. Sometimes this client is
diconnected.
Is there a way that I can know if that MAC address exist
on the LAN ? can I know the IP address which is attached to this
MAC address ?

I know that there is a protocol which is called RARP which
is supposed to handel mac-to-ip translations; but as I looked in ip-utils
(to whic many net utils like ping belong), the rarpd seems to me something
different.

regards,
John

(E-Mail Removed) (john) wrote:

> Is there a way that I can know if that MAC address exist
> on the LAN ? can I know the IP address which is attached to this
> MAC address ?

You could try 'ping -b BROADCASTADDRESS' and after that have a look at
your ARP cache 'arp -a'.

--
RTFM: No just an acronym, it's the LAW!

john wrote:

> Hello,
>
> I have a certain client which I know it's MAC address ; the IP
> of the client is cahnged from time to time. Sometimes this client is
> diconnected.
> Is there a way that I can know if that MAC address exist
> on the LAN ? can I know the IP address which is attached to this
> MAC address ?

As already mentioned, pinging the broadcast address could be the solution.
Using arping in loop could also work.

loop address < broadcast_address; i=network_address+1; address++
result = arping -c 1 -I eth0 address
grep MAC address from result
if MAC found
print IP address and exit loop
else
continue

Regards
Kimmo Koivisto

john wrote:

> Is there a way that I can know if that MAC address exist
> on the LAN ? can I know the IP address which is attached to this
> MAC address ?

Do a broadcast ping and then grep your arp cache for that mac. If that
computer is configured to respond to pings, you should see it.

--

(This space intentionally left blank)

Bernhard Kastner wrote:

> James Knott schrieb:
>>
>> If that
>> computer is configured to respond to pings, you should see it.
>>
>
> $ echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcast
>

I believe you're missing an "s" at the end of that. Anyway, mine is already
"0".

--

(This space intentionally left blank)

Bernhard Kastner <(E-Mail Removed)> wrote:
> James Knott schrieb:
>>
>> If that
>> computer is configured to respond to pings, you should see it.
>>

> $ echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcast

echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

--
Clifford Kite Email: "echo xvgr_yvahk-(E-Mail Removed)|rot13"
PPP-Q&A links, downloads: http://ckite.no-ip.net/
/* "Be liberal in what you accept, and conservative in what you send"
RFC 1122 */

James Knott schrieb:
>
> If that
> computer is configured to respond to pings, you should see it.
>

$ echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcast

--
Bernhard | theEdge
-Linux User #368478-
http://www.alf.at.tc
Austrian Linux Forum

Clifford Kite wrote:

> Bernhard Kastner <(E-Mail Removed)> wrote:

>> $ echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcast
>
> echo 0 > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
>

Either way, I don't think it will do a lot, if the computer in question is
running Windows. ;-)

--

(This space intentionally left blank)

In article <(E-Mail Removed) >, john wrote:

>I have a certain client which I know it's MAC address ; the IP
>of the client is cahnged from time to time. Sometimes this client is
>diconnected.
>Is there a way that I can know if that MAC address exist on the LAN ?

Others have already given you the answers - arping, or pinging the
broadcast address. Note that some O/S do not reply to a broadcast
ping, and that people often firewall or otherwise disable ping. If
all else fails, check the ARP cache on router or DNS server.

>can I know the IP address which is attached to this MAC address ?

Well, now you know yet another disadvantage of dynamic addressing.

>I know that there is a protocol which is called RARP which
>is supposed to handel mac-to-ip translations; but as I looked in ip-utils
>(to whic many net utils like ping belong), the rarpd seems to me something
>different.

RARP is quite different from ARP. It's normally used by a diskless
workstation at boot time to find it's own address. It sends out a
RARP request hoping that a RARP server knows (from looking in a table)
what the host with 'this' MAC address has for an IP address. It doesn't
work without that server. See RFC0903. Briefly, the conversation goes
something like

[client broadcast] My MAC address is 08:00:07:EF:43:9C - WHO AM I???

[server to client] 08:00:07:EF:43:9C your address is 192.168.1.12

but the server can't answer unless it has that table (often /etc/ethers),
and the table is normally 'fixed'.

Old guy