How to ping MAC address in Linux

Question

I want to ping a known MAC address, I tried to use nmap:

sudo nmap -sP 192.168.15.1/24 | grep  20:64:32:3F:B1:A9

But in this case its ping all the 255 IP address (from 192.168.15.1 to 192.168.15.255) until get my MAC address, and that take a long time about 4 sec.!

any idea please?

Solution 1

The only way to make it faster is to test if the mac address is already into your arp table

#!/bin/bash

# extract ip from local arp table
ip=$(arp | grep 20:64:32:3F:B1:A9 | awk ' { print $1 } ')

# found an ip tied to the mac address?
if [ ! -z $ip ]; then

    # if found, do you want to ping it?
    ping $ip
else
    echo "Not found into local arp table. Trying another way..."

    # wanna try your nmap strategy?
    # sudo nmap -sP 192.168.15.1/24 | grep  20:64:32:3F:B1:A9
fi;

Solution 2

You can't ping a MAC address. You can only ping an IP address, so what you're trying to do is find out what IP address belongs to a certain MAC Address and ping that IP. ARP is used to find the MAC address of a machine with a certain IP address, but you can't really go the other way around (technically a protocol called Reverse ARP exists, but it's never used in typical operating systems). Once the MAC address is found, it'll be kept in the ARP cache so you don't have to look it up again for a few minutes, but that's not a reliable way to find the MAC because entries don't stay in the cache long. You figured out how to make a static entry, but if you're hard coding 192.168.15.196 to that MAC address, why don't you just ping 192.168.15.196 (that's all you're doing anyway)?

Solution 3

nmap has the -T option to speed things like this up. -T 5 is the fastest.

You can also try the --min-parallelism option.

Solution 4

Combining the above good answers into a single script: (Usage: macping aa:bb:cc:dd:ee:ff)

#!/bin/bash
network=192.168.1.1/24
if [ "$#" -ne 1 ]; then echo Usage example: $0 aa:bb:cc:dd:ee:ff; exit 2; fi;
nmap -sP -T4 $network >& /dev/null
ip=$(arp -n | grep $1 | awk ' { print $1 }')
ping $ip -n -q -c 2 -i 0.2 -w 1 >& /dev/null
if [ $? -eq 0 ]; then
    echo Device is online \($ip\)
else
    echo Device is offline
    exit 1
fi;

Extending: To maintain a list of network devices, by mac address, and display the online/offline status of each.
Uses include:

• Monitoring your server status's
• checking your internet connection is up
• checking if a specific device has connected to your wifi
• checking your smart TV is really off
• etc

Each device name is displayed in green if online, red if offline.
A desktop notification is displayed when a device status changes.

Tested under linux mint, should work on other distro's.

#!/bin/bash

#Create associated array's 
declare -A devicelist #device name: mac address
declare -A statuslist #device name: online status

devicelist[Server01]=aa:bb:cc:dd:ee:01
devicelist[Server02]=aa:bb:cc:dd:ee:02
devicelist[MyPhone] =aa:bb:cc:dd:ee:03
devicelist[SmartTV] =aa:bb:cc:dd:ee:04

#Colour Constants
BRed='\033[1;31m'  
BGreen='\033[1;32m' 
Reset='\033[m'

function mactoip(){
  echo $(arp -n | grep -i $mac | awk ' { print $1 }')
}

while [ true ]; do
    clear
    arp_cache_rebuilt=no
    for devicename in ${!devicelist[@]}; do
        status=OFFLINE
        mac=${devicelist[${devicename}]}
        ip=$( mactoip $mac )
        if [ -z $ip ] && [ $arp_cache_rebuilt = "no" ]; then
            #we need to rebuild the arp cache...
            nmap -sn -T4 192.168.1.0/24 >& /dev/null
            ip=$( mactoip $mac )
            arp_cache_rebuilt=yes
        fi;

        if [ ! -z $ip ]; then
            ping $ip -n -q -c 2 -i 0.2 -w 1 >& /dev/null
            if [ $? -eq 0 ]; then status=ONLINE; fi
        fi;
        #if device's previous status not yet recorded, then set it now.
        if [ ! ${statuslist[${devicename}]+_} ]; then statuslist[${devicename}]=$status; fi

        if [ $status = "ONLINE" ]; then colour=$BGreen; else colour=$BRed; fi;
        echo -e ${colour}${devicename}${Reset} - $ip
        if [ ${statuslist[${devicename}]} != $status ]; then
          notify-send -i ac-adapter -u critical -t 1000 $status "$devicename"
        fi;
        statuslist[$devicename]=$status
    done
    echo -
    sleep 5
done

Solution 5

Here is another and rather simpler answer.

ping $(arp-scan --localnet | grep 80:1f:02:fa:90:b7  | awk ' { printf $1 } ')

Note that the mac address has to use lower case letters.

arp-scan seems to run much faster than arp.

View more solutions

Comments

[Linux]

Thinks for reply, the code doesn't work, it gave me: Usage: ping [-LRUbdfnqrvVaAD] [-c count] [-i interval] [-w deadline] [-p pattern] [-s packetsize] [-t ttl] [-I interface] [-M pmtudisc-hint] [-m mark] [-S sndbuf][-T tstamp-options] [-Q tos] [hop1 ...] destination

[Linux]

Ok, this is a good solution and its work, but it is always gave me "Not found into local arp table. Trying another way..." even I used another mac address while both are found in the local network! That is mean the mac address is not in the arp tabel. How to insert it into the table? I used sudo nmap -sP 192.168.15.1/24 | grep 20:64:32:3F:B1:A9, but it still not in the arp table?

[Linux]

I added the mac address by sudo arp -s 192.168.15.196 20:64:32:3F:B1:A9, I do not know if this is the right way.I think it should be added automatically since the mac address is found in the local network, but anyway, your script work now very good. Thanks for the solution.

[Mtl Dev]

using "arp -n" will make it a lot faster, from 17.0 seconds to 0.003 seconds

[Pierre]

Excellent stuff, very useful to monitor who's connecting on my network. Now... I'm connected to my company's network through a VPN: would there be a way to get this arp magic to work on the distant network? I've tried a bit, without success so far.

[Pierre]

As I often copy and paste terminal contents here and there, colours tend to fade away during that transfer. Therefore, I slightly modified your script to cope with colour-blind and textual copy-pastes: I just replaced the colours' definition as follows: ` BRed='\033[1;31m [ OFF ] ' BGreen='\033[1;32m [ ON ] ' ` I also changed the clear at the beginning of the loop, for an echo "_________________________________________" Just a matter of taste, I guess...

[amphetamachine]

nmap needs --send-ip in order to update the system ARP table.