How to translate a MAC / Ether address to an ip address

[Michael Anderson_1]

Hi,

One of my 10.20 machines is getting flooded with packets every 2 mins or so. I have done some tracing and found the mac address of the maching that is producing the packets. However i am unable to find this machine - is there a way to use a mac / ether to find the ip address assigned to that card (I have tried using arp -a on the maching that is being flooded without luck)

[Dan Hetzel · Accepted solution]

Hi Michael,

arp -a doesn't work because the system being flooded never needed to talk to the other.
What you can do, on the flooded system, is issue a ping to the broadcast address.
Do ifconfig lan?? to know that address.

This will force the flooding machine to answer and arp -a will work then. Redirect the arp -a command into a file because the output could be quite long. You could then grep for your mac address in that file.

It's not very elegant and network intensive so, interrupt your ping with after a few seconds. :-((

Best regards,

Dan

[Carlos Fernandez Riera]

Before do arp -a ping all your net using the net address:

ping 192.44.53.0 # if netmask is 255.255.255.0

[CHRIS_ANORUO]

Hi Michael,

Read more on arp (man 7 arp). The default broadcast address ends usually with (.255), i.e. W.X.Y.255.
You can use lanscan to get the Interface name of the card that has Interface state as "UP" (lan0 or lan1 as the case may be). The use ifconfig lan?? to get the broadcast address.