Is there an easy way to do a host lookup by MAC address on a LAN?

Question

Is there an easy way (on Linux) to implement host lookup by MAC address? In small local networks, it is easy to use for example arp-scan to find out the IP address of some device.

I usually use zeroconf/avahi or routers providing DNS by hostnames, but sometimes I can not rely on such features.

So is it possible by some bash magic or small tool to get the system resolving hostnames encoding this MAC addresses, like for example a3_af_32_44_68_c9.local, to get a more reliable host lookup in small networks?

Solution 1

Try using an arp command like this:

arp -n | grep [set MAC address here] | awk '{print $1}'

Or using your example MAC address like this:

arp -n | grep a3.af.32.44.68.c9 | awk '{print $1}'

• The arp -n will list all of the devices arp is aware of with numeric addresses without hostnames or anything else.
• The grep will simply use grep to only filter items that correspond to the MAC address you want to lookup.
• The awk '{print $1}' will simply return the IP address of the value returned by the grep/awk combo that preceded it.

The net result of that is if the MAC address matches you will get the IP address connected to that MAC address.

Solution 2

I think you're running into what I believe is a serious mis-feature of the isc-dhcp server. This program records the Ethernet address of every device it has ever seen and the IP address that it assigned to it. But it never uses this information to keep the same devices on stable IP addresses. Instead it makes the assumption that are aren't enough IP addresses available and preferentially reuses addresses.

The only way I've found to get around this is to make your DHCP server always assign a specific IP address to every device you have. That way you have the best of both worlds ... everything is assigned an IP with dhcp but that IP never changes.

---

OTOH, if you really do want the IP address assigned to a particular MAC address the best you're going to do without outside help is to scan the subnet. If you try to ping every (local) IP address your arp table arp -a will include all the MAC addresses and their assigned IPs. There is even a special command for this arp-scan --localnet which forgets to do the PING. NOTE: this works even if they ignore PING packets because they can't ignore the ARP requests that are sent out first.

With outside help you can do the lookup on the DHCP server this DHCP client for example lets you query any MAC want. Of course it'll allocate it too as a side effect.

---

Here's an example using arp-scan.

set -e
grep -v 'mac.local #DYN' /etc/hosts > /etc/hosts.new

arp-scan --localnet -qg |
    grep ':..:..:..:..:' |
    sed -e 's/:/_/g' -e 's/$/.mac.local #DYN/' >> /etc/hosts.new

[ -s /etc/hosts.new ] && {
    cmp -s /etc/hosts.new /etc/hosts ||
    mv /etc/hosts.new /etc/hosts
}

Obviously this only works for machines on the same subnet. The name will change if the Ethernet card is replaced or the machine is cloned to new hardware. MAC addresses can be changed manually with the ifconfig command for tasks such as 'MAC Cloning' that may be required by DSL modems or interface bonding or similar.

Comments

[milli]

What is your use case? This is rather vague. If you have networking setup properly, you do not need to violate the network stack layers like this.

[dronus]

Consider: I make some devices. Others make some devices. They all met, another one connects a router. All leave. Some day someone replaces the router. I cannot configure the router, neither the other devices. The owner of the whole mess likes it if it just works. So at day one, when I bring my device, I have to configure it to just work as long as possible, interoperating with some other of the devices. That's all. If all machines would serve zeroconf with smooth names and the router would relay it between LAN / WLAN etc. all would be fine. Of course this never happend.

[dronus]

Some LAN routers does in fact show such behaviour by default, and assign stable IP adresses as long there are enough left. However, I cannot rely on a feature some routers have. Some other routers expose linux hostnames in their DNS, which is a cool feature, but again this is not for granted. So when working with foreign networks, I need a reliable name assignment. Which may be done by avahi, if all devices are delivered by me. But foreign devices may not have avahi services running, so the only way to find those devices reliable would be the MAC address.

[user3710044]

Okaaay, but how do you find the MAC address of some device you have never seen before?

[user3710044]

Well, you've got me wondering what you're doing... this application you want to run on these machines, is it yours? Could you perhaps avoid the problem of making-up random names for the machines by just sending out a multicast packet from each one saying "Hello please call me on w.x.y.z". Your "hostname" analogue can then be just a UUID. After all that's all avahi does (in the most annoying manner possible of course).

[dronus]

Yes, I like that way to find out the IP adress, but I cannot use the MAC address in some software expecing an internet address / URL / hostname. So my question is about how to map the MAC address to some local host address that any software can look up.

[Svetoslav Marinov]

this works nicely. In my case I received two lines. Maybe the mac was cached or something. So if you're parsing that output you have to split on new lines.