Tuesday, 4 October 2011

Can IP Addresses be Determined From MAC Addresses?

Question: Can IP Addresses be Determined From MAC Addresses?
A MAC address represents the physical identifier of a network adapter, while the IP address represents a logical device address on Internet Protocol networks. A built-in feature of IP, Address Resolution Protocol (ARP) translates IP addresses to MAC addresses. ARP was not designed to translate addresses in the other direction, however.
Answer: Computers can determine IP addresses from MAC addresses using DHCP (and formerly other protocols like RARP and InARP). There is no universal mechanism for an end user to determine an IP address given a known MAC address, although it can be done in certain specific situations.

ARP Cache

ARP maintains a list of both IP addresses and matching MAC addresses called the ARP cache. These caches are available on individual network adapters and also on IP routers. From the cache it is possible to derive an IP address from a MAC address; however, the mechanism is limited in many respects.
On Windows and some other operating systems, the "arp" command provides access to the local ARP cache. In Windows, for example, typing "arp -a" at the command (DOS) prompt will display all of the entries in that computer's ARP cache. Depending on how that local network is configured, however, this cache will often remain empty. At best, a client device's ARP cache only contains entries for other computers on the LAN.
Most home broadband routers allow viewing of their ARP caches through their Web-based administrative interface. This feature reveals both IP and MAC addresses for every device currently joined to the home network. Note that in general, routers will not maintain IP-to-MAC address mappings for devices on other networks. Entries for these remote devices may appear in the ARP list, but in those cases, the MAC address shown will normally correspond to a remote LAN router, not to the device actually located at that logical address.

Network Management Software

Some corporate networks solve the problem of universal MAC-to-IP address mapping by installing special management software agents on all computers. These software systems, based on Simple Network Management Protocol (SNMP), include a capability called network discovery. These systems forward messages out to the agent on every network device a request for both the IP and MAC addresses of that device. The system receives then stores the results in a master table separate from any individual ARP cache. With Internet Protocol, network discovery is often implemented using ping commands and Internet Control Message Protocol (ICMP) messages. Pinging a remote device from any client will trigger an ARP cache update. Typically this update occurs only in the ARP cache of the LAN routers and not on the originating client, however.