Get MAC address of a directly connected device

11,073

If I'm not mistaken, ARP could be used to receive a MAC address of a machine. If you are connected at the data-link layer, I believe you can execute arp -an on a Linux machine to retrieve the MAC addresses of connected devices.

I've only used it to retrieve the MAC address associated with IP addresses, as that's what its usual function is - however due to the connectivity being over layer two, and that it uses the Ethernet broadcast address (FFFF.FFFF.FFFF), it should hopefully be able to retrieve the MAC address alone without an associated IP address.

I'm not actually able to test the above theory, but please let me know if you have any luck.

Share:
11,073

Related videos on Youtube

Recct
Author by

Recct

Updated on September 18, 2022

Comments

  • Recct
    Recct almost 2 years

    Given a Linux server with an ethernet card, another device say an unconfigured router is connected with a patch lead (or an ethernet lead cabled in a different way if needed).

    They're both powered up. Is there a way on the linux box to get the MAC address of the other device? There's no IP network going on here just two connected ethernet interfaces.

    EDIT: The devices that this is concerning come with base config expecting to get an IP off a DHCP server which I can run on the linux host and work off that as soon as they get their temp IP.

    • yaegashi
      yaegashi almost 9 years
      I think you have no chance to know peer's ethernet address unless the peer spontaneously sends something / responds to something you sent in some protocol like STP, ARP (IPv4), NDP (IPv6). Can't you assume anything on that?
    • Recct
      Recct almost 9 years
      Well the router will broadcast a request looking for a DHCP server by default but I'm more on the programmer side of things I'm not sure how that works, L2 broadcast isnt it?
    • Incnis Mrsi
      Incnis Mrsi almost 9 years
      Not an answer to question, as it stands, but those who aim at IP connection over a direct Ethernet patch link may use ifconfig iface pointopoint IP.address.of.another.point That will make ARP unnecessary. See ifconfig(8) for details.
    • Mark Plotnick
      Mark Plotnick almost 9 years
      It depends on how the unconfigured router behaves. Will it accept and send packets, or not send anything until configured? If you can tell us the router model that will help.
    • Recct
      Recct almost 9 years
      Cisco 1841.. but I suppose it will need to be more universal (main target are Ciscos though here)
    • Mark Plotnick
      Mark Plotnick almost 9 years
      You might want to try setting any IP address on the Linux system's Ethernet interface and then run ping -b 255.255.255.255 and then arp -a -n. There's no universal way to remotely discern an unconfigured router port's MAC because some routers do not enable ports until they're configured to do so.
    • Recct
      Recct almost 9 years
      Yes useful ideas. As it turns out routers come with some basic config that will ask for DHCP when it comes up so I can do what Mark and Hugh's answer suggest!
    • Admin
      Admin about 2 years
      Many routers use LLDP for discovery. You may use command tshark -i <imterface> -Y lldp to capture LLDP packets, which contain peer MAC address.
  • Recct
    Recct almost 9 years
    I'll have to dig out some cables and test yeah
  • Admin
    Admin about 2 years
    ARP stands for Address Resolution Protocol and it maps IP addresses to MAC addresses. It is not limited to layer 2, rather it is used for mapping Layer 3 addresses to Layer 2 addresses.