It is common for network administrators and computer users to PING a device to find the IP address of a website, a host, or even a hostname. But, what if the only information you had was a MAC address and you needed to find out to whom it belonged?
Perhaps you want to dig for more information based on a MAC address that has been listed in your router or you need to know who has been accessing your local network. Well, finding an IP address from a MAC address is the topic we will be looking at in this article.
IP address vs. MAC address
Let’s delve right in, have a look at these two terms, and discuss what they are and why we need them at all.
Define IP address
An Internet Protocol or IP address is a numerical label or address assigned to each device that is connected to a computer network that uses IP (Internet Protocol) for communication.
An IP address serves two primary purposes: for host or network interface identification and location addressing of a connected device. This address can be assigned manually by configuring a device to save a Static IP Address, or automatically by a DHCP server (Dynamic Host Configuration Protocol server) which assigns a Dynamic IP Address.
An IP address can be in the format of xxx.xxx.xxx.xxx (IP V4) or abcd:efgh:ijkl:mnop:qrst:uvwx:yzab:cdef (IP V6). It is also always unique – no two devices on the same subnet can have the same IP address. If they do, it will cause an IP address conflict.
Define MAC address
A Media Access Control or MAC address is also a uniquely assigned address. Like an IP address, a MAC address also serves as an identifier for each device. But, in this case, the address is assigned to the hardware that is used to make the connection possible. In the case of a desktop or laptop computer, this hardware is the Network Interface Card (NIC).
MAC addresses are written in the “AA:BB:CC:DD:DD:FF” format. The first three numbers (i.e. AA:BB:CC) are used to identify a NIC’s manufacturer and are known as an Organizational Unique Identifier (OUI). The OUI is followed by a unique identifier since here too there can be no two devices with the same MAC address.
From the image above, we can see that a MAC address is a hexadecimal number. The NIC converts this hexadecimal number of the MAC address into binary numbers before processing and using it on the network.
Therefore, we can now say that a MAC address is a unique hardware identification number that is assigned to a NIC, whereas an IP address is an address that helps you identify a network connection that leads to the NIC, and thence, the host machine.
Finally, we need to remember that connected devices can each have two IP addresses:
- A Private or Internal IP address: this is to be used on a Local Area Network (LAN) and for connectivity and messaging within an internal network. The ranges are best explained in the table below:
| Prefix | IP From… | IP To… | Total No. of Addresses |
|---|---|---|---|
| 10.0.0.0/8 | 10.0.0.0 | 10.255.255.255 | 16,777,216 |
| 172.16.0.0/12 | 172.16.0.0 | 172.31.255.255 | 1,048,576 |
| 192.168.0.0/16 | 192.168.0.0 | 192.168.255.255 | 65,536 |
These addresses (and hence the devices) are not globally reachable, and cannot be searched or accessed from beyond the LAN. Also, they are not necessarily unique identifiers – a private IP can be used in two different network subnets.
- A Public or External IP address: this address is used to connect to the Internet – for a global online presence.
The IP range for these addresses is from 0.0.0.0 to 255.255.255.255 – the whole range (with the exception of private IP addresses and a few unusable or reserved IPs, of course).
Devices and hosts with public or external IPs are globally accessible and can be reached from beyond the network they are on. The addresses are unique across the Internet and can even be used to determine the location of a device because each country is assigned a range of addresses by the Internet Assigned Numbers Authority (IANA) and its regional subsidiary agencies that include AFRINIC (Africa), ARIN (USA, Canada, and some Caribbean nations), APNIC (Far East and Australia), LACNIC (Mexico, Central America, and South America), and RIPE NCC (Europe, Middle East, and Central Asia). This makes it easy to find out where a user is connecting from.
OK; but why do we need both an IP and a MAC address?
This is a valid question considering the fact that each address uniquely identifies a host or device. But, take into consideration the fact that although TCP/IP – which uses the IP protocol – remains the most popular communication (in fact, it can be said to be the most dominant one since the Internet uses it), it is not the ONLY transport protocol.
For example, IPX/SPX (Internetwork Packet Exchange/Sequenced Packet Exchange) addresses each computer using the MAC address (and some additional information). This makes it necessary for an alternative device addressing system.
How to find your own IP and MAC addresses
We will now look at how you can find the IP and MAC addresses of your machine or another one that is connected to the network.
Windows systems
- Go to START ->
- Type “CMD” or “Command” to get to the Command Prompt application.
- When the Command Prompt shortcut appears, right-click on it and select “Run as administrator”.
4. In the command prompt CLI, type “IPConfig/all” and you should see something similar to:
In this screenshot, the Physical Address is the MAC address 70-71-BC-69-03-EB.
Incidentally, the IP addresses (in two IP protocol formats) are: 10.0.110.219 (IPv4) and fe80::a034:180d:4963:369a%10 (IPv6).
Linux systems
There are several ways of displaying your IP address from your Linux CLI. The three best ways are using the commands:
- ip address
- ifconfig –a
- hostname –i
As can be seen in the image above, the three commands display different outputs. The first command – ip address – is the most informative one. What’s more, it can also be used to get further, detailed information by throwing in some arguments. Just have a look at the help to get an idea of the parameters you can use:
Adding these arguments to the ip command results in details and grants access control (as well as configuration capabilities) of routes, neighboring devices, and even the network, for example.
Note: the screenshot was taken from an emulator (hence the IP address 127.0.0.1 – the default address for IPv4 loopback traffic) and your output will likely vary from the screenshot.
macOS systems
On a macOS device:
- Open System Preferences – by clicking the Apple logo dropdown menu.
- Go to Internet & Wireless.
- Click on
- Choose the connection device – Wi-Fi or Ethernet – that is green (indicating a live connection).
- When selected, it should say Connected and show you the IP address on the right side.
Image source: OSXDaily.
A little lower, and to the right, you will be able to see the Options button. Click on it and you will be able to see more information, including the device’s MAC address.
If you’re more of a technical user, you can opt to run Terminal to find out your (local) IP address using the command “ipconfig getifaddr en0”.
Image source: Tridev Computer.
Finally, we shouldn’t forget that the Linux commands also work on macOS:
Note: here too, we have used an emulator and the results may look different on your screen.
How to find MAC addresses on a network
Next, let us see how we can find the MAC addresses of the devices on a segment of a network. The protocol we will be using is the Address Resolution Protocol or ARP.
This protocol helps routers by translating IP addresses into MAC addresses (or vice versa) to make it easy for data packets to be delivered to the right host. The result is displayed in a table that allows you to easily identify which IP address belongs to what MAC address.
From your command line – in any operating system – you can use the “arp –a” command to list the MAC addresses in your network segment. Here’s what it will look like on a Windows machine:
To see what the arp command does you can run the command “arp /?” to invoke the help feature.
Moving on to a Linux emulator, it would look like this:
And, finally, on a macOS CLI the result would look like this:
Remember, although we have just seen that we can find the MAC addresses using the arp command, as network users, we can only see the addresses of the devices that are on the same subnet we are on. Administrators, on the other hand, can have the detailed information of the whole network at their disposal.
Windows Active Directory (AD), for example, gives you the whole network’s MAC address information as Unique IDs in its DHCP list. This list also provides the corresponding IP addresses.
Image source: The Backroom Tech
Other Methods used to find the IP address using MAC Address
OK; we have spent time looking into how you can find the IP address and MAC addresses using commands and, in some instances, features in administrative tools like Microsoft’s AD. The disadvantages here are that:
- Manually typing in the CLI commands is too tedious a task to perform in larger networks where conflicts and issues occur too often.
- This is also why round-the-clock monitoring for rogue devices would be out of the question – (unless of course some technical know-how was acquired to run scripts that automated the scanning tasks).
- Using enterprise tools like Microsoft’s AD could be out of the reach of businesses and network owners with smaller budgets; and besides, it wouldn’t make sense for them to invest in them at all as the ROI wouldn’t be worth it.
The best IP address to MAC address (or vice versa) resolution tools would, therefore, be free network monitoring tools that can perform these tasks without the need for human intervention.
IP Address Detection Tools
Here is our list of four free tools that can be used for IP address detection:
- Spiceworks IP Scanner This free, online tool is able to scan any network and it is easy to use. The system is part of an IT asset inventory system and can be used in conjunction with the Spiceworks Help Desk package, which is also free to use.
- Eusing Free IP Scanner A small, quick utility for Windows that gives a scan of a range of IP addresses, detailing the associated MAC address plus other details.
- ManageEngine OpUtils Free Edition A partial implementation of a comprehensive paid tool that offers IP address resolution plus other handy network scanning functions. Runs on Windows Server and Linux.
- Paessler PRTG Use a limited number of functions from this package of tools and you don’t have to pay anything. Includes an IP scanner and runs on Windows Server.
Our methodology for selecting an address management system
We reviewed the utilities for IP address detection and analyzed the options based on the following criteria:
- A tool that matches assigned IP addresses to device MAC addresses
- An indication of whether an IP address is fixed or temporary
- Detection for duplicate IP address allocation
- DNS resolution to display hostnames
- Cross-platform capabilities
- A free trial or a free tool for assessment without paying
- A free version of a paid tool or a completely free system that is worth using
Using this set of criteria, we looked for IP address detection tools that cross-reference to MAC addresses and also looked for systems that amount to small, free IP address management systems that provide better services than just an IP address lookup function.
1. Spiceworks IP Scanner
For companies that have a mixed operating system topology, it makes sense to use Spiceworks’ IP Scanner because it can scan for devices running Windows, Linux, or OSX. It is also efficient because, as a cloud tool that uses a tiny agent to do the scanning, it doesn’t affect your network’s performance or interfere with the devices’ execution as they are being queried.
The IP scanner requires an agent to be installed on your network before it can operate properly. The system scans the network and returns a sortable list of the devices it discovers. That device inventory shows details, such as name, manufacturer, IP address, operating system, and MAC address. Admins can see the last time a device was polled to find out if it is currently up or down.
Key Features:
- Part of an IT asset inventory tool
- On demand scanning
- Rudimentary vulnerability scanner
- Patch requirements list
- Online tool
Why do we recommend it?
Spiceworks IP Scanner is a free online tool. It is able to connect to networks through agents which means that it can scan any network that you own no matter where it is.
The tool will also identify ports on endpoints that are open. It shows which devices have operating systems that are not up to date, which is a good tool for security scanning, creating a list of devices that need to be patched.
This is a handy suite of tools on its own, but there are many more solutions from Spiceworks that it can integrate with for even more effectiveness in network administration.
Spiceworks IP Scanner is a competent, online tool that is completely free to use. The IP Scanner is part of an IT asset inventory package that will automatically detect and record the hardware connected to your network. As this is a cloud-based system, you can use it to manage remote networks. The tool ties in with a free Help Desk package as well so you can get a large part of all of your support team’s software needs taken care of by Spiceworks at no cost.
Who is it recommended for?
Despite the global reach of this tool, it is more likely to be used by small businesses that don’t want to invest in full system monitoring packages, such as PRTG.
Pros:
- The agent can be installed on Windows, Linux, or Mac
- Ideal tool for longer-term monitoring
- Great interface makes it easy to view all ports, services, and their current state
Cons:
- Won’t work offline, but great for simple web-based monitoring
You can start using SpiceWorks IP Scanner by signing up for FREE.
2. Eusing Free IP Scanner
This tool is for admins who choose to only use Windows computers. It is a tiny (433 KB) but a nifty tool to quickly run and scan all the devices that are on a network.
This tool gives quick feedback on network addressing statuses with displays that provide a list of all devices connected to the network, showing IP addresses, MAC addresses, user names, and any open ports.
The user can choose to scan just a part of the network address space or even focus on just one IP address to see whether it is in use. It is possible to enter a non-consecutive list of addresses to scan, which can be loaded in from a text file.
Key Features:
- Scans a range of addresses or the entire network
- Shows all system addresses
- Multi-threaded architecture
- Exportable results
Why do we recommend it?
Eusing Free IP Scanner is able to map IP addresses to MAC addresses by searching a network. It can also be set up to run a scan of port statuses on each discovered device. The IP scanner provides an on-demand service on a local network.
Scans return very quickly because the tool uses a multi-threaded architecture than spawns parallel processes. As well as seeing the results in the utility, you can export the list to a CSV file for examination in a spreadsheet or other analysis tool
Users of this free IP scanner will appreciate the fact that it is a tool that was created for the precise purpose it was named after and is easy to use and extract information from.
Who is it recommended for?
This IP scanner is a useful tool for any network administrator to have available. It is good for troubleshooting and also periodic checks that all devices are still contactable. You could use this tool as a visual Ping or to identify a specific device.
Pros:
- Lightweight application – great for legacy machines
- Provides simple information on address ranges, hostnames, ports, and user
- Allows users to limit their scanning range
Cons:
- Better suited for short tests, not applicable for long-term monitoring
Download your copy of Eusing IP Scanner for FREE.
3. ManageEngine OpUtils
ManageEngine’s OpUtils comes to us from Zoho, a company that is well-known for its online office and business software suites. With OpUtils too, it has continued to uphold this tradition and has delivered a high-quality tool that offers superior performance.
OpUtils is a network monitor and switch port mapper. This package is available for installation on Windows Server or Linux on premises. The paid version of the system can also be added as a service to an account on AWS. You can get a 30-day free trial of the full edition or opt for the Free version, which provides 16 of the paid version’s utilities, which include an IP scanner.
Key Features:
- IP address and MAC address mapping
- Scans entire network or a range of addresses
- Shows each device’s manufacturer
Why do we recommend it?
ManageEngine OpUtils specialist package offers every type of address tracking. That includes IP addresses, MAC addresses, port numbers, and switch ports.
As well as showing a list of IP addresses in use with the MAC addresses of the devices that those addresses are allocated to, this system offers DNS and DHCP server checks. This cross-reference lets you identify if any unauthorized devices are connected to the network. You can also see which devices have been allocated static addresses.
Performance troubleshooting tools, such as Ping and Traceroute are also included in the free version of OpUtils.
With this tool in hand, administrators can not only resolve (back and forth) between their MAC and IP addresses but also take full control of their network and connected devices. Needless to say, this is a tool for businesses and administrators of larger networks.
Who is it recommended for?
ManageEngine produces a large library of IT monitoring and management tools and typically, a system administrator will progress in a series of acquisitions, adding to the corporate system management suite. OpUtils is probably the second package on everyone’s list and it would be used as an add-on to OpManager, which is the main network monitoring service from ManageEngine.
Pros:
- Supports IP management and physical switch port monitoring
- Offers built-in troubleshooting tools to help
- Supports CISCO and SNMP tools to help configure, administer and diagnose issues
- Better suited for sysadmin
Cons:
- Offers many advanced features and options, not suited for small home networks
You can download your FULL FREE version of ManageEngine OpUtils here (the tool reverts to the free version after 30 days).
4. Paessler PRTG Network Monitor
Paessler PRTG is a collection of IT system monitors and you decide how many to activate. You don’t have to pay anything for the package if you only activate 100 monitors. The core function of PRTG automatically detects all devices on the network, logs them in an inventory, and creates a network topology map. The system provides every addressing detail for each device, which includes IP address, MAC address, and hostname.
This tool can be as limited or as comprehensive as you choose. However, remember not to go over 100 sensors if you don’t want to pay. The system also provides Ping and Traceroute utilities for testing plus live performance monitoring with SNMP and bandwidth measurements through NetFlow, sFlow, IPFIX, and J-Flow.
Key Features:
- Live IP address scans
- MAC address and hostname mapping
- Spots addressing anomalies
Why do we recommend it?
Paessler PRTG is more than an IP address finder. It is a complete system monitoring package that offers network, server, and application monitoring. The tool includes a discovery module that populates an IT asset inventory. This record includes both the IP address and the MAC address of each device.
The network monitoring services in PRTG will raise an alert if a performance issue arises. This means that you don’t have to sit and watch the monitor in order to catch problems.
Who is it recommended for?
The Paessler PRTG package is very large and ideal for a large enterprise. The free version means it can also be considered by small businesses looking for an IP address scanner.
Pros:
- Repetitive address scans run automatically
- Additional network performance monitoring
- Systems to track traffic issues
Cons:
- Free version is only included with the on-premises edition
The software for PRTG installs on Windows Server. There is a hosted version based in the cloud but that doesn’t have a free option. You can access a 30-day free trial of the full PRTG system with all sensors activated. If you choose not to buy at the end of the trial period, your installation switches to the free version and you can enjoy unlimited use of up to 100 sensors for free.
What other information can you get from a MAC address?
Now, some might still wonder why they would need to resolve a MAC address into an IP address. Well, apart from finding the IP address of a device, there is more information that can be extracted from a MAC address, including:
- Network – once the IP address has been identified, it is easy to determine the network it is connected to.
- Hostname – using the ping command will show the device’s name and more detailed descriptive information.
- Manufacturer – most NICs are “tagged” by the companies that make them; this information can be used to build a clearer profile of the connected device.
Finally, it is important to know that a MAC address cannot be propagated beyond your local area network. In fact, the router uses the MAC addresses to easily identify the devices that are connected within the local network.
This means that if you can see a MAC address listed in the router (by using the arp command, for example) and you realize it doesn’t belong to one of your own devices, then there is a chance you might have a rouge device connected directly to your network!
Alternatively, you can reverse this theory and consider the fact that, since your MAC address is registered in a router (that also maps it to an IP address), the information can be used to trace your online activity. This can be avoided with the help of a VPN or proxy server, especially when you need to ensure your privacy.
Well, that’s that. Let us know what you think about the relationship between your IP and MAC addresses by leaving us a comment below.
IP Address FAQs
Can you find IP address from MAC address?
Identify all IP addresses and MAC addresses on a network quickly by getting a list at the command prompt. You do this with the command arp -a. Alternatively, use a graphical tool that performs the ARP scan for you and displays results in a better format.
How do I find my PC’s MAC address?
To find the MAC address of your Windows computer:
- Click on the Start menu and then on the Settings cog.
- Click on Network & Internet in the first screen that appears.
- In the Settings screen, scroll down in the Status panel and click on View hardware and connection properties.
- You will see the MAC address listed as Physical address (MAC).
What does ARP mean?
ARP is the Address Resolution Protocol. It is the system that network systems use to map IP address allocations to the physical addresses of devices on the network. Physical addresses are known as MAC addresses. MAC stands for Media Access Control and each network adapter has this address, which is globally unique, hard-coded onto it.
