hostname or ip by physical address

[savvyuser]

Hi Guys,

Anyone here knows a software or tool that would determine the hostname of remote computer and only given is machine physical address.

 

[Tezdread]

open command promt cmd.exe and type: nslookup the IP Address of the remote server/pc and this will give you the name for that IP.

Tezdread
"With every solution comes a new problem"

 

[TravisM]

That won't work, because he doesn't have the IP or the hostname. What you have to do is trick arp.

Open up a command prompt and type

arp -s 157.55.85.212 00-aa-00-62-c6-09

(That was taken directly from teh arp help screen) now you have added a static entry on your PC that 00-aa-00-62-c6-09 has the IP address 157.55.85.212. In reality what you'll want to do is put in the physical address that you have and replace the IP address with an IP that is on the same logical network that the PC is on.

Now you can start querying the machine, I'd use nbtstat -a 157.55.85.212, and you'll get it's netbios name... That should give you a start anyway.

 

[Tezdread]

ah I see...(said the blind man) I'm confused?! Probably not understanding 'physical address' (if someone can explain?)

If you don't know 'where' the PC is how do you get it's physical address?

If you can get the physical address why can't you get the IP/Name from the same source?

Tezdread
"With every solution comes a new problem"

 

[TravisM]

Tough to say why he wouldn't have it, but the Physical address is the unique MAC address that every network device has, assigned from the maufacturer.

Only scenario I can think of is maybe he has a specific NIC he's looking for, maybe he has the box it came in or something that has the MAC on it, but doesn't know where the hardware ended up... Could then find the hostname and go right to the machine.

I honestly can't come up with anything legit either, the solution I gave isn't really all that great for doing what he's trying to do - but off the top of my head it's the only thing I can think of other than pulling a switch or router report, which his hardware may or may not support.

 

[pweegar]

Here's a wrench to help muddle things. MAC address, altho they are supposed to be unique, aren't necc. so!!!!! Had a couple of different pairs of 3Com cards a few years back that contained the identical MAC address!!! That was fun... to say the least!

 

[Tezdread]

I had a bit of a lookup for the info too, MAC address I've heard of but I found something else I don't quite get...

When I typed ARP -a it gave me 00-07-40-35-cd-s0

but when I type ipconfig /all it's not the same?

Tezdread
"With every solution comes a new problem"

 

[TravisM]

arp -a is going to give you the MAC addresses of remote machines, or arp entries for "other" ips. If you want to quicly find out the MAC address of a remote host on your network that you have the IP for, just ping it, then type arp -a and you'll see the IP address you were pinging on the left, and the machines MAC address on the right.

Basically, when two machines are communicating over TCP/IP, they're really just two machines who know the MAC or "hardware" address of the other machine, since that's what the machines really need to figure out in order to talk, regardless of the protocol.

 

[Tezdread]

cool nice one for the explanation

Tezdread
"With every solution comes a new problem"