Find the MAC address of another computer using ARP

To find the hardware/MAC address of another computer on the network using ARP in Debian/Ubuntu, follow these steps:

---

1. Ping the Target Computer (Optional but Recommended)

ping <IP-address>

Example:

ping 192.168.1.10

• This sends packets to the target computer, ensuring the ARP cache gets populated with its MAC address.

---

2. Check the ARP Table for the MAC Address

arp -a

Example Output:

? (192.168.1.10) at 00:1a:2b:3c:4d:5e [ether] on eth0

• The MAC address is 00:1a:2b:3c:4d:5e for IP 192.168.1.10.

---

3. Alternative – Use ip Command to View Neighbor Table

ip neigh show

Example Output:

192.168.1.10 dev eth0 lladdr 00:1a:2b:3c:4d:5e REACHABLE

• lladdr represents the MAC address.

---

4. To Target a Specific IP

arp -n | grep 192.168.1.10

• This filters for the specific IP address directly.

---

5. Flush the ARP Cache (Optional – If No Results Appear)

sudo ip -s -s neigh flush all

• This clears stale ARP entries. Re-run the ping and arp commands afterward.

---

6. Install ARP if Not Available

sudo apt install net-tools

---

Example Workflow:

1. Ping the target:

   
   ping 192.168.1.15
   

2. Check ARP table:

   
   arp -a
   

3. Find the specific IP:

   
   arp -n | grep 192.168.1.15
   

---

How ARP Works:

• ARP (Address Resolution Protocol) maps IP addresses to MAC addresses within the same network.
• When you ping a device, the OS uses ARP to find the corresponding MAC address if it's not already in the cache.