CODEWITHSUNDEEP
ip-addressmac-address
JnBrymn
JnBrymn

Reputation: 25373

arp command - what does it all mean? *and* getting a wireless router MAC address from IP

When I type in arp -a in my bash shell, I get output that looks like the following:

? (10.0.0.1) at 0:f0:7f:43:e8:68 on en1 ifscope [ethernet]
box1.google.com (10.0.0.3) at 0:1f:fe:fe:ca:d4 on en1 ifscope [ethernet]
box2.google.com (10.0.0.2) at 0:2:a3:45:90:bf on en1 ifscope [ethernet]
box3.google.com (10.0.0.50) at 78:e7:df:7c:34:c on en1 ifscope [ethernet]
box4.google.com (10.0.0.230) at 0:80:74:c9:50:d5 on en1 ifscope [ethernet]
box5.google.com (10.0.0.256) at 0:23:df:91:4f:9e on en1 ifscope [ethernet]
box6.google.com (10.0.0.458) at 0:15:9:89:36:68 on en1 ifscope [ethernet]
? (10.0.0.179) at 0:2a:32:f0:f4:d0 on en1 ifscope [ethernet]
box7.google.com (10.0.0.283) at 0:27:16:66:2d:ef on en1 ifscope [ethernet]
box8.google.com (10.0.0.386) at 0:13:eb:91:d8:b5 on en1 ifscope [ethernet]
box9.google.com (10.0.0.287) at 0:1c:25:10:d8:89 on en1 ifscope [ethernet]
? (10.0.0.255) at (incomplete) on en1 ifscope [ethernet]
? (172.17.122.255) at (incomplete) on vmnet8 ifscope [ethernet]
? (172.17.254.1) at 0:50:56:c0:0:1 on vmnet1 ifscope permanent [ethernet]
? (172.17.254.255) at (incomplete) on vmnet1 ifscope [ethernet]

What does all of this mean? I loosely understand that I'm seeing domain names, IP addresses (internal IP addresses?), and MAC addresses. How do I find the MAC address for the wireless router that I'm connected to? Why are there so many entries here? I figured that there would only be one for my computer, one for the wireless router, one for the cable modem, and then possibly some other things upstream... but I'm seeing other computers that are not mine. Furthermore, I am not seeing my computer. Also, could I somehow use information like this to find the MAC addresses for wireless routers in public? What if I can not connect to said public routers?

Upvotes: 4

Views: 10979

Answers (2)

sleepyhead
sleepyhead

Reputation: 398

You must have anonymized the output because the ip-address 10.0.0.458 is impossible and the mac-addresses may be fake too.

A mac address with 48 bits (EUI-48) is 6-byte long. The first 3 bytes are assigned to the vendor, you can download a long list of assigned vendors from IEEE or use an online service like

http://coffer.com/mac_find/

On the interface EN1 there is device with a mac address belonging to an HP Procurve currently using ip-address 10.0.0.3.

A question mark means that the hostname could not be resolved (using a reversed DNS lookup) and 'incomplete' means that the device has not been seen on the network for some time. if it is 'permanent' the mac address will not be marked as stale, so it should not go into 'incomplete' regardless if the device has communicated or not.

Upvotes: 0

Draineh
Draineh

Reputation: 598

At a guess 10.0.0.1 looks like the gateway. Why do you want to find the MAC address for the router you are on? Also, if you cannot connect to a wireless router then you won't be able to find it with this command, there are some other commands you can use to scan for wireless signals. You don't see your computer on there because this is your local arp table, why would you need to know where you are? You're already there.

Upvotes: 1

Related Questions