how to get MAC address of remote computer

Question

I have specific situation. I want to get MAC address from a remote computer, which is not in domain. I know the hostname and IP address of the remote computer. The IP Address of my computer is 192.168.2.40 and the remote computer IP is 192.168.2.41.

I've tried:

arp -a <remote IP Address>
No ARP entries found.

nbtstat -n <remote hostname>
Host not found.

getmac /s <remote IP Address>
ERROR: The RPC server is unavailable.

Is it possible to get the MAC address of the remote system from the command line, powershell or something else? Which conditions need to be set? Thank you.

Solution 1

nmap will return the MAC address as well as just about anything else you'd like to know.

If you have admin access to the machine, powershell & wmi are both very useful in getting remote diagnostics. They both have extensive documentation at technet.microsoft.com

edit: this assumes a windows machine, which from the looks of it, this might not be.

Solution 2

MAC addresses are Ethernet things, not Internet things. A computer need not even have a MAC address. The only way to get the MAC address is to get some computer on the same LAN as that computer to tell it to you. And you'd have no way to know it was giving you the correct information.

If the two of you are in the same Ethernet LAN, you can just ping the computer and then look in your ARP table. Otherwise, you would have to ask a computer in the same Etherent/Wifi LAN.

Solution 3

You can get it from WMI, and any language that can read WMI will be able to access it. VBScript, JScript, Perl, Python, and Powershell can all be used to get to it.

Since you asked specifically Powershell, here's an example from http://www.neolisk.com/techblog/powershell-getmacaddressofanyremoteip:

param ( $Computer , $Credential )
#to make it work without parameters
if($Computer -eq $null) { $Computer = $env:COMPUTERNAME }
#program logic
$hostIp = [System.Net.Dns]::GetHostByName($Computer).AddressList[0].IpAddressToString
if($Credential) {
    $Credential = Get-Credential $Credential
    $wmi = gwmi -Class Win32_NetworkAdapterConfiguration -Credential $Credential -ComputerName $Computer
} else {
    $wmi = gwmi -Class Win32_NetworkAdapterConfiguration -ComputerName $Computer 
}
return ($wmi | where { $_.IpAddress -eq $hostIp }).MACAddress

Solution 4

yep. The easiest way should be just doing a ping and then check the ARP table

If you're more into actually getting stuff inventoried and reported I would suggest havoing a look at the free software from Spiceworks ( http://www.spiceworks.com ) to set upp constant monitoring and always havce your information easily available about your entire enivorenment.

I've used it for years and it works great on LAN.

It does have some issues with sending inventories ocf sofwtare to remote sites though, haven't really figured out why yet but apart from that, I highly recommend it .

Solution 5

If you know name of computer easies way will be:

$strComputer ="ComuterName"
$colItems = Get-WmiObject -Class "Win32_NetworkAdapterConfiguration" -ComputerName $strComputer -Filter "IpEnabled = TRUE"
ForEach ($objItem in $colItems)
{
    write-host "IP Address: " $objItem.IpAddress[0]  "Mac: " $objItem.MacAddress
}

More advanced script which can take any machine by IP or hostname:

$device = "192.168.106.123"
if ( $device | ? { $_ -match "[0-9].[0-9].[0-9].[0-9]" } )
{
    echo "Searching MAC by IP"
    $ip = $device
} 
else 
{
    echo "Searching MAC by host"
    $ip = [System.Net.Dns]::GetHostByName($device).AddressList[0].IpAddressToString
}
    $ping = ( new-object System.Net.NetworkInformation.Ping ).Send($ip);


if($ping){
    $mac = arp -a $ip;

    ( $mac | ? { $_ -match $ip } ) -match "([0-9A-F]{2}([:-][0-9A-F]{2}){5})" | out-null;

    if ( $matches )
     {
        $matches[0];
    } else 
    {
      echo "MAC Not Found"
     }
}

View more solutions

Comments

[Admin]

ipconfig /all ?

[Admin]

Have you tried just arp -a with other parameter?

[Admin]

ott, which parameter is also useful to get mac address?

[Admin]

@culter Better late than never. I meant arp -a without other parameters.

[David Schwartz]

Please explain the downvote so I can improve the answer.

[David Schwartz]

@MDMarra: That's why I said "The only way to get the MAC address is to get some computer on the same LAN as that computer to tell it to you."

[MDMarra]

I can run a remote PowerShell command or psexec against a computer that's not on my LAN as long as the proper ports are open and I have admin credentials. I think this might be a safe bet, since the OP is posted an RFC1918 address as the target system.

[gWaldo]

"A computer need not even have a MAC address." "You'd have no way to know it was giving you the correct information." Both of those are patently false statements.

[David Schwartz]

@gWaldo: I stand by both of them. There's a computer right behind me that has a fractional T1 connection and no other network interfaces. It has no MAC address but Internet connectivity. And please, tell me how you could tell if a remote computer was telling you a correct MAC address rather than a nonsense one.

[jhayes]

David is absolutely correct. However, in this instance, with the IP listed in the question, I think it's a safe assumption OP isn't dealing with any out of the ordinary situation. Though there is too much information missing to be able to go into more specifics about what might or might not be.

[MDMarra]

I agree that a MAC isn't a requirement for IP connectivity when you're not using Ethernet - this is absolutely correct, but saying that you can't trust what WMI returns as the MAC is a bit farfetched. If you're going to take an edge stance like that, you should defend it in detail and not just expect people to accept your minority view as truth. How is it possible to configure a Windows client so that a WMI query returns a value for the MAC address that's different than the one that the network stack uses for the same NIC?

[gWaldo]

He did tag the question with Windows and Powershell...

[jhayes]

true, but based on the return values I'm not convinced the target is Windows. Could just be locked down, nmap -v -A 192.168.2.41 would be helpful.

[culter]

The computers are windows based, but there is nmap for windows and it works fine. Nmap was the only tool that works in this situation. Thank you.

[culter]

Thanks to finland, my favorite country full of great metal bands;) I'll check that.

[Andrew Schulman]

Sorry, what do you mean by "what is above"? If you're referring to another answer, please be more specific since your answer may appear by itself or in a different order.

[ChrisW]

Just look at the lengths to which this topic goes. All that is needed is arp -a <IP> and AHAW responded with code. while nice just over complicated.

[Andrew Schulman]

My point is just that "above" is meaningless when your answer may appear by itself, or in an unknown order with other answers. Please be more specific.

[Jaro]

The catch with nbtstat is that it only works for remote Windows machines - not 100% sure; it also requires some digging on the command syntax as well...

[Jaro]

Also, the "getmac /s [hostname/IP] can be used only on those remote Windows targets that have RPC enabled, are available to you remotely, and you also have remote admin rights on the system.

[Jaro]

Some other network scanners (Nessus, Nexpose, Metasploit) might also be able to report this data for you as well...

[Falcon Momot]

Welcome to server fault! If you want, you can edit your answer after you create it to add additional content - this looks a lot better than comments.

[David Schwartz]

@MDMarra But the point is that that's meaningless. Sure, you can get the one the network stack uses for that NIC. But that connection could be strictly between the Windows VM and the host machine. So you're getting, with 100% accuracy, an entirely meaningless number.