It is common for network administrators and computer users to PING a device to find the IP address of a website, a host, or even a hostname. But, what if the only information you had was a MAC address and you needed to find out to whom it belonged?

Perhaps you want to dig for more information based on a MAC address that has been listed in your router or you need to know who has been accessing your local network. Well, finding an IP address from a MAC address is the topic we will be looking at in this article.

Let’s delve right in, have a look at these two terms, and discuss what they are and why we need them at all.

An Internet Protocol or IP address is a numerical label or address assigned to each device that is connected to a computer network that uses IP (Internet Protocol) for communication.

An IP address serves two primary purposes: for host or network interface identification and location addressing of a connected device. This address can be assigned manually by configuring a device to save a Static IP Address, or automatically by a DHCP server (Dynamic Host Configuration Protocol server) which assigns a Dynamic IP Address.

An IP address can be in the format of xxx.xxx.xxx.xxx (IP V4) or abcd:efgh:ijkl:mnop:qrst:uvwx:yzab:cdef (IP V6). It is also always unique – no two devices on the same subnet can have the same IP address. If they do, it will cause an IP address conflict.

A Media Access Control or MAC address is also a uniquely assigned address. Like an IP address, a MAC address also serves as an identifier for each device. But, in this case, the address is assigned to the hardware that is used to make the connection possible. In the case of a desktop or laptop computer, this hardware is the Network Interface Card (NIC).

MAC addresses are written in the “AA:BB:CC:DD:DD:FF” format. The first three numbers (i.e. AA:BB:CC) are used to identify a NIC’s manufacturer and are known as an Organizational Unique Identifier (OUI). The OUI is followed by a unique identifier since here too there can be no two devices with the same MAC address.

From the image above, we can see that a MAC address is a hexadecimal number. The NIC converts this hexadecimal number of the MAC address into binary numbers before processing and using it on the network.

Therefore, we can now say that a MAC address is a unique hardware identification number that is assigned to a NIC, whereas an IP address is an address that helps you identify a network connection that leads to the NIC, and thence, the host machine.

These addresses (and hence the devices) are not globally reachable, and cannot be searched or accessed from beyond the LAN. Also, they are not necessarily unique identifiers – a private IP can be used in two different network subnets.

The IP range for these addresses is from 0.0.0.0 to 255.255.255.255 – the whole range (with the exception of private IP addresses and a few unusable or reserved IPs, of course).

Devices and hosts with public or external IPs are globally accessible and can be reached from beyond the network they are on. The addresses are unique across the Internet and can even be used to determine the location of a device because each country is assigned a range of addresses by the Internet Assigned Numbers Authority (IANA) and its regional subsidiary agencies that include AFRINIC (Africa), ARIN (USA, Canada, and some Caribbean nations), APNIC (Far East and Australia), LACNIC (Mexico, Central America, and South America), and RIPE NCC (Europe, Middle East, and Central Asia). This makes it easy to find out where a user is connecting from.

This is a valid question considering the fact that each address uniquely identifies a host or device. But, take into consideration the fact that although TCP/IP – which uses the IP protocol – remains the most popular communication (in fact, it can be said to be the most dominant one since the Internet uses it), it is not the ONLY transport protocol.

For example, IPX/SPX (Internetwork Packet Exchange/Sequenced Packet Exchange) addresses each computer using the MAC address (and some additional information). This makes it necessary for an alternative device addressing system.

We will now look at how you can find the IP and MAC addresses of your machine or another one that is connected to the network.

4. In the command prompt CLI, type “IPConfig/all” and you should see something similar to:

In this screenshot, the Physical Address is the MAC address 70-71-BC-69-03-EB.

Incidentally, the IP addresses (in two IP protocol formats) are: 10.0.110.219 (IPv4) and fe80::a034:180d:4963:369a%10 (IPv6).

There are several ways of displaying your IP address from your Linux CLI. The three best ways are using the commands:

As can be seen in the image above, the three commands display different outputs. The first command – ip address – is the most informative one. What’s more, it can also be used to get further, detailed information by throwing in some arguments. Just have a look at the help to get an idea of the parameters you can use:

Adding these arguments to the ip command results in details and grants access control (as well as configuration capabilities) of routes, neighboring devices, and even the network, for example.

Note: the screenshot was taken from an emulator (hence the IP address 127.0.0.1 – the default address for IPv4 loopback traffic) and your output will likely vary from the screenshot.

On a macOS device:

Image source: OSXDaily.

A little lower, and to the right, you will be able to see the Options button. Click on it and you will be able to see more information, including the device’s MAC address.

If you’re more of a technical user, you can opt to run Terminal to find out your (local) IP address using the command “ipconfig getifaddr en0”.

Image source: Tridev Computer.

Finally, we shouldn’t forget that the Linux commands also work on macOS:

Note: here too, we have used an emulator and the results may look different on your screen.

Next, let us see how we can find the MAC addresses of the devices on a segment of a network. The protocol we will be using is the Address Resolution Protocol or ARP.

This protocol helps routers by translating IP addresses into MAC addresses (or vice versa) to make it easy for data packets to be delivered to the right host. The result is displayed in a table that allows you to easily identify which IP address belongs to what MAC address.

From your command line – in any operating system – you can use the “arp –a” command to list the MAC addresses in your network segment. Here’s what it will look like on a Windows machine:

To see what the arp command does you can run the command “arp /?” to invoke the help feature.

Moving on to a Linux emulator, it would look like this:

And, finally, on a macOS CLI the result would look like this:

Remember, although we have just seen that we can find the MAC addresses using the arp command, as network users, we can only see the addresses of the devices that are on the same subnet we are on. Administrators, on the other hand, can have the detailed information of the whole network at their disposal.

Windows Active Directory (AD), for example, gives you the whole network’s MAC address information as Unique IDs in its DHCP list. This list also provides the corresponding IP addresses.

Image source: The Backroom Tech

OK; we have spent time looking into how you can find the IP address and MAC addresses using commands and, in some instances, features in administrative tools like Microsoft’s AD. The disadvantages here are that:

The best IP address to MAC address (or vice versa) resolution tools would, therefore, be free network monitoring tools that can perform these tasks without the need for human intervention.

Here is our list of four free tools that can be used for IP address detection:

We reviewed the utilities for IP address detection and analyzed the options based on the following criteria:

Using this set of criteria, we looked for IP address detection tools that cross-reference to MAC addresses and also looked for systems that amount to small, free IP address management systems that provide better services than just an IP address lookup function.

For companies that have a mixed operating system topology, it makes sense to use Spiceworks’ IP Scanner because it can scan for devices running Windows, Linux, or OSX. It is also efficient because, as a cloud tool that uses a tiny agent to do the scanning, it doesn’t affect your network’s performance or interfere with the devices’ execution as they are being queried.

The IP scanner requires an agent to be installed on your network before it can operate properly. The system scans the network and returns a sortable list of the devices it discovers. That device inventory shows details, such as name, manufacturer, IP address, operating system, and MAC address. Admins can see the last time a device was polled to find out if it is currently up or down.

Key Features:

Spiceworks IP Scanner is a free online tool. It is able to connect to networks through agents which means that it can scan any network that you own no matter where it is.

The tool will also identify ports on endpoints that are open. It shows which devices have operating systems that are not up to date, which is a good tool for security scanning, creating a list of devices that need to be patched.

This is a handy suite of tools on its own, but there are many more solutions from Spiceworks that it can integrate with for even more effectiveness in network administration.

Spiceworks IP Scanner is a competent, online tool that is completely free to use. The IP Scanner is part of an IT asset inventory package that will automatically detect and record the hardware connected to your network. As this is a cloud-based system, you can use it to manage remote networks. The tool ties in with a free Help Desk package as well so you can get a large part of all of your support team’s software needs taken care of by Spiceworks at no cost.

Despite the global reach of this tool, it is more likely to be used by small businesses that don’t want to invest in full system monitoring packages, such as PRTG.

You can start using SpiceWorks IP Scanner by signing up for FREE.

This tool is for admins who choose to only use Windows computers. It is a tiny (433 KB) but a nifty tool to quickly run and scan all the devices that are on a network.

This tool gives quick feedback on network addressing statuses with displays that provide a list of all devices connected to the network, showing IP addresses, MAC addresses, user names, and any open ports.

The user can choose to scan just a part of the network address space or even focus on just one IP address to see whether it is in use. It is possible to enter a non-consecutive list of addresses to scan, which can be loaded in from a text file.

Key Features:

Eusing Free IP Scanner is able to map IP addresses to MAC addresses by searching a network. It can also be set up to run a scan of port statuses on each discovered device. The IP scanner provides an on-demand service on a local network.

Scans return very quickly because the tool uses a multi-threaded architecture than spawns parallel processes. As well as seeing the results in the utility, you can export the list to a CSV file for examination in a spreadsheet or other analysis tool

Users of this free IP scanner will appreciate the fact that it is a tool that was created for the precise purpose it was named after and is easy to use and extract information from.

This IP scanner is a useful tool for any network administrator to have available. It is good for troubleshooting and also periodic checks that all devices are still contactable. You could use this tool as a visual Ping or to identify a specific device.

Download your copy of Eusing IP Scanner for FREE.

ManageEngine’s OpUtils comes to us from Zoho, a company that is well-known for its online office and business software suites. With OpUtils too, it has continued to uphold this tradition and has delivered a high-quality tool that offers superior performance.

OpUtils is a network monitor and switch port mapper. This package is available for installation on Windows Server or Linux on premises. The paid version of the system can also be added as a service to an account on AWS. You can get a 30-day free trial of the full edition or opt for the Free version, which provides 16 of the paid version’s utilities, which include an IP scanner.

Key Features:

ManageEngine OpUtils specialist package offers every type of address tracking. That includes IP addresses, MAC addresses, port numbers, and switch ports.

As well as showing a list of IP addresses in use with the MAC addresses of the devices that those addresses are allocated to, this system offers DNS and DHCP server checks. This cross-reference lets you identify if any unauthorized devices are connected to the network. You can also see which devices have been allocated static addresses.

Performance troubleshooting tools, such as Ping and Traceroute are also included in the free version of OpUtils.

With this tool in hand, administrators can not only resolve (back and forth) between their MAC and IP addresses but also take full control of their network and connected devices. Needless to say, this is a tool for businesses and administrators of larger networks.

ManageEngine produces a large library of IT monitoring and management tools and typically, a system administrator will progress in a series of acquisitions, adding to the corporate system management suite. OpUtils is probably the second package on everyone’s list and it would be used as an add-on to OpManager, which is the main network monitoring service from ManageEngine.

You can download your FULL FREE version of ManageEngine OpUtils here (the tool reverts to the free version after 30 days).

Paessler PRTG is a collection of IT system monitors and you decide how many to activate. You don’t have to pay anything for the package if you only activate 100 monitors. The core function of PRTG automatically detects all devices on the network, logs them in an inventory, and creates a network topology map. The system provides every addressing detail for each device, which includes IP address, MAC address, and hostname.

This tool can be as limited or as comprehensive as you choose. However, remember not to go over 100 sensors if you don’t want to pay. The system also provides Ping and Traceroute utilities for testing plus live performance monitoring with SNMP and bandwidth measurements through NetFlow, sFlow, IPFIX, and J-Flow.

Key Features:

Paessler PRTG is more than an IP address finder. It is a complete system monitoring package that offers network, server, and application monitoring. The tool includes a discovery module that populates an IT asset inventory. This record includes both the IP address and the MAC address of each device.

The network monitoring services in PRTG will raise an alert if a performance issue arises. This means that you don’t have to sit and watch the monitor in order to catch problems.

The Paessler PRTG package is very large and ideal for a large enterprise. The free version means it can also be considered by small businesses looking for an IP address scanner.

The software for PRTG installs on Windows Server. There is a hosted version based in the cloud but that doesn’t have a free option. You can access a 30-day free trial of the full PRTG system with all sensors activated. If you choose not to buy at the end of the trial period, your installation switches to the free version and you can enjoy unlimited use of up to 100 sensors for free.

Now, some might still wonder why they would need to resolve a MAC address into an IP address. Well, apart from finding the IP address of a device, there is more information that can be extracted from a MAC address, including:

Finally, it is important to know that a MAC address cannot be propagated beyond your local area network. In fact, the router uses the MAC addresses to easily identify the devices that are connected within the local network.

This means that if you can see a MAC address listed in the router (by using the arp command, for example) and you realize it doesn’t belong to one of your own devices, then there is a chance you might have a rouge device connected directly to your network!

Alternatively, you can reverse this theory and consider the fact that, since your MAC address is registered in a router (that also maps it to an IP address), the information can be used to trace your online activity. This can be avoided with the help of a VPN or proxy server, especially when you need to ensure your privacy.

Well, that’s that. Let us know what you think about the relationship between your IP and MAC addresses by leaving us a comment below.

Identify all IP addresses and MAC addresses on a network quickly by getting a list at the command prompt. You do this with the command arp -a. Alternatively, use a graphical tool that performs the ARP scan for you and displays results in a better format. 

To find the MAC address of your Windows computer:

ARP is the Address Resolution Protocol. It is the system that network systems use to map IP address allocations to the physical addresses of devices on the network. Physical addresses are known as MAC addresses. MAC stands for Media Access Control and each network adapter has this address, which is globally unique, hard-coded onto it.