1

I am trying to find MAC addresses from devices that show up on arp -a scans on my wifi network. How can I get MAC addresses from these results of calling "arp -a" in Mac terminal?

? (10.10.40.1) at 0:90:b:2e:bf:ff on en0 ifscope [ethernet]
us114-appletv.francisparker.org (10.10.40.92) at 0:90:b:2e:bf:ff on en0 ifscope [ethernet]
03089mac.francisparker.org (10.10.40.236) at 0:90:b:2e:bf:ff on en0 ifscope [ethernet]
02543mac.francisparker.org (10.10.41.9) at 0:90:b:2e:bf:ff on en0 ifscope [ethernet]
us113-dwalcott-0.francisparker.org (10.10.41.83) at 0:90:b:2e:bf:ff on en0 ifscope [ethernet]
meghans-air.francisparker.org (10.10.41.123) at 0:90:b:2e:bf:ff on en0 ifscope [ethernet]
faiths-mbp-2.francisparker.org (10.10.41.132) at 0:90:b:2e:bf:ff on en0 ifscope [ethernet]
09150mac.francisparker.org (10.10.41.144) at 0:90:b:2e:bf:ff on en0 ifscope [ethernet]
02758mac.francisparker.org (10.10.41.219) at 0:90:b:2e:bf:ff on en0 ifscope [ethernet]
02769mac.francisparker.org (10.10.41.234) at 0:90:b:2e:bf:ff on en0 ifscope [ethernet]
? (10.10.42.99) at 0:90:b:2e:bf:ff on en0 ifscope [ethernet]
? (10.10.42.113) at 0:90:b:2e:bf:ff on en0 ifscope [ethernet]
? (10.10.44.44) at 0:90:b:2e:bf:ff on en0 ifscope [ethernet]
? (10.10.44.201) at 0:90:b:2e:bf:ff on en0 ifscope [ethernet]
? (10.10.45.77) at 0:90:b:2e:bf:ff on en0 ifscope [ethernet]
? (10.10.45.123) at 0:90:b:2e:bf:ff on en0 ifscope [ethernet]
? (10.10.45.151) at 0:90:b:2e:bf:ff on en0 ifscope [ethernet]
? (10.10.46.6) at 0:90:b:2e:bf:ff on en0 ifscope [ethernet]
? (10.10.46.137) at 0:90:b:2e:bf:ff on en0 ifscope [ethernet]

Thanks!

pbullard2017
  • 21
  • 4

2 Answers2

1

Your question is somewhat unclear; the MAC addresses are clearly listed in the above output. I assume you mean "how do I convert the arp output into a newline separated list of MAC addresses?" That's just a trivial cut to get the fourth column.

arp -a | cut -d' ' -f 4
Rob Napier
  • 286,113
  • 34
  • 456
  • 610
  • 1
    Sorry for the unclear question. I am still wondering why the output of your suggestion give the same MAC address for each line? also, it is in a different format that when I look up my own MAC address – pbullard2017 Sep 25 '15 at 17:41
  • 1
    You likely have a network appliance (maybe a switch, maybe a security appliance) that is returning itself as the address for all the IPs it knows about. Looks like the gear is built by Lanner. http://www.lannerinc.com I don't know what MAC address format you're expecting. Those look pretty normal. The octets just don't have leading zeros (sometimes tools print the leading zero, sometimes they don't) – Rob Napier Sep 25 '15 at 18:13
  • Any way to get the device MAC rather than the one returned for all devices? Btw thanks for your help so far. Learning a lot! – pbullard2017 Sep 25 '15 at 19:44
  • If there is a network device between you and the network card that is hiding its MAC, then no. MACs are for link-level addressing. If the device is logically further away than that, then you can't get it directly. (You of course can get it indirectly, by doing things like logging into the device and then querying it locally.) Some related questions: http://stackoverflow.com/questions/17516669/is-it-possible-to-get-the-visitors-mac-address-in-rails http://stackoverflow.com/questions/8046725/get-mac-address-of-remote-pc http://stackoverflow.com/questions/3385/mac-addresses-in-javascript – Rob Napier Sep 25 '15 at 21:36
0

Try:

arp -n xxx.xxx.xxx.xxx

e.g. my Zyxel router MAC address:

arp -n 192.168.1.1

shows:

? (192.168.1.1) at c8:6c:87:xx:xx:xx on en0 ifscope [ethernet]

michel
  • 1
  • 1