how to get MAC address of remote computer

Question

I have specific situation. I want to get MAC address from a remote computer, which is not in domain. I know the hostname and IP address of the remote computer. The IP Address of my computer is 192.168.2.40 and the remote computer IP is 192.168.2.41.

I've tried:

arp -a <remote IP Address>
No ARP entries found.

nbtstat -n <remote hostname>
Host not found.

getmac /s <remote IP Address>
ERROR: The RPC server is unavailable.

Is it possible to get the MAC address of the remote system from the command line, powershell or something else? Which conditions need to be set? Thank you.

@culter Better late than never. I meant `arp -a` without other parameters. — ott--, Sep 17 '15 at 21:34

score 8 · Answer 1 · answered Jul 25 '12 at 12:47

8

MAC addresses are Ethernet things, not Internet things. A computer need not even have a MAC address. The only way to get the MAC address is to get some computer on the same LAN as that computer to tell it to you. And you'd have no way to know it was giving you the correct information.

If the two of you are in the same Ethernet LAN, you can just ping the computer and then look in your ARP table. Otherwise, you would have to ask a computer in the same Etherent/Wifi LAN.

answered Jul 25 '12 at 12:47

David Schwartz

31,215
2
53
82

Please explain the downvote so I can improve the answer. – David Schwartz Jul 25 '12 at 12:48
2

Because there are at least a dozen ways to get the MAC address of a remote computer using tools like psexec, PowerShell with Get-WMIObject or Invoke-Command, wmic, etc. – MDMarra Jul 25 '12 at 12:49
1

@MDMarra: That's why I said "The only way to get the MAC address is to get some computer on the same LAN as that computer to tell it to you." – David Schwartz Jul 25 '12 at 12:50
I can run a remote PowerShell command or psexec against a computer that's not on my LAN as long as the proper ports are open and I have admin credentials. I think this might be a safe bet, since the OP is posted an RFC1918 address as the target system. – MDMarra Jul 25 '12 at 12:51
"A computer need not even have a MAC address." "You'd have no way to know it was giving you the correct information." Both of those are patently false statements. – gWaldo Jul 25 '12 at 13:15
3

@gWaldo: I stand by both of them. There's a computer right behind me that has a fractional T1 connection and no other network interfaces. It has no MAC address but Internet connectivity. And please, tell me how you could tell if a remote computer was telling you a correct MAC address rather than a nonsense one. – David Schwartz Jul 25 '12 at 13:25
David is absolutely correct. However, in this instance, with the IP listed in the question, I think it's a safe assumption OP isn't dealing with any out of the ordinary situation. Though there is too much information missing to be able to go into more specifics about what might or might not be. – jhayes Jul 25 '12 at 13:57
3

I agree that a MAC isn't a requirement for IP connectivity when you're not using Ethernet - this is absolutely correct, *but* saying that you can't trust what WMI returns as the MAC is a bit farfetched. If you're going to take an edge stance like that, you should defend it in detail and not just expect people to accept your minority view as truth. How is it possible to configure a Windows client so that a WMI query returns a value for the MAC address that's different than the one that the network stack uses for the same NIC? – MDMarra Jul 25 '12 at 14:02
@MDMarra But the point is that that's meaningless. Sure, you can get the one the network stack uses for that NIC. But that connection could be strictly between the Windows VM and the host machine. So you're getting, with 100% accuracy, an entirely meaningless number. – David Schwartz May 05 '16 at 05:34

jhayes · Accepted Answer · 2012-07-25T13:59:59.200

7

nmap will return the MAC address as well as just about anything else you'd like to know.

If you have admin access to the machine, powershell & wmi are both very useful in getting remote diagnostics. They both have extensive documentation at technet.microsoft.com

edit: this assumes a windows machine, which from the looks of it, this might not be.

edited Jul 25 '12 at 13:59

answered Jul 25 '12 at 13:52

jhayes

476
2
6
12

2

He did tag the question with Windows and Powershell... – gWaldo Jul 25 '12 at 15:20
1

true, but based on the return values I'm not convinced the target is Windows. Could just be locked down, nmap -v -A 192.168.2.41 would be helpful. – jhayes Jul 25 '12 at 15:28
1

The computers are windows based, but there is nmap for windows and it works fine. Nmap was the only tool that works in this situation. Thank you. – culter Jul 27 '12 at 06:54

score 6 · Answer 3 · answered Jul 25 '12 at 12:50

You can get it from WMI, and any language that can read WMI will be able to access it. VBScript, JScript, Perl, Python, and Powershell can all be used to get to it.

Since you asked specifically Powershell, here's an example from http://www.neolisk.com/techblog/powershell-getmacaddressofanyremoteip:

param ( $Computer , $Credential )
#to make it work without parameters
if($Computer -eq $null) { $Computer = $env:COMPUTERNAME }
#program logic
$hostIp = [System.Net.Dns]::GetHostByName($Computer).AddressList[0].IpAddressToString
if($Credential) {
    $Credential = Get-Credential $Credential
    $wmi = gwmi -Class Win32_NetworkAdapterConfiguration -Credential $Credential -ComputerName $Computer
} else {
    $wmi = gwmi -Class Win32_NetworkAdapterConfiguration -ComputerName $Computer 
}
return ($wmi | where { $_.IpAddress -eq $hostIp }).MACAddress

I cant get it work. When I add name of computer into $computer, the output is nothing. — culter, Jul 27 '12 at 06:52

score 3 · Answer 4 · answered Jul 25 '12 at 13:11

yep. The easiest way should be just doing a ping and then check the ARP table

If you're more into actually getting stuff inventoried and reported I would suggest havoing a look at the free software from Spiceworks ( http://www.spiceworks.com ) to set upp constant monitoring and always havce your information easily available about your entire enivorenment.

I've used it for years and it works great on LAN.

It does have some issues with sending inventories ocf sofwtare to remote sites though, haven't really figured out why yet but apart from that, I highly recommend it .

Thanks to finland, my favorite country full of great metal bands;) I'll check that. — culter, Jul 27 '12 at 06:57

ahaw · Answer 5 · 2014-02-21T11:37:45.077

If you know name of computer easies way will be:

$strComputer ="ComuterName"
$colItems = Get-WmiObject -Class "Win32_NetworkAdapterConfiguration" -ComputerName $strComputer -Filter "IpEnabled = TRUE"
ForEach ($objItem in $colItems)
{
    write-host "IP Address: " $objItem.IpAddress[0]  "Mac: " $objItem.MacAddress
}

More advanced script which can take any machine by IP or hostname:

$device = "192.168.106.123"
if ( $device | ? { $_ -match "[0-9].[0-9].[0-9].[0-9]" } )
{
    echo "Searching MAC by IP"
    $ip = $device
} 
else 
{
    echo "Searching MAC by host"
    $ip = [System.Net.Dns]::GetHostByName($device).AddressList[0].IpAddressToString
}
    $ping = ( new-object System.Net.NetworkInformation.Ping ).Send($ip);


if($ping){
    $mac = arp -a $ip;

    ( $mac | ? { $_ -match $ip } ) -match "([0-9A-F]{2}([:-][0-9A-F]{2}){5})" | out-null;

    if ( $matches )
     {
        $matches[0];
    } else 
    {
      echo "MAC Not Found"
     }
}

score 2 · Answer 6 · answered Feb 21 '14 at 13:57

2

MAC is OSI Layer 2 - you won't get it directly when there is any Layer 3 hop in between - and for securtity reasons all protocols to query such data should not be allowed in anything beyond one's LAN...

answered Feb 21 '14 at 13:57

Truebsalgeblaese

364
1
4

score 2 · Answer 7 · edited Apr 10 '15 at 15:20

2

While what is above is a bit over complicated, if you have no entries found after a ping then you need to enable routing and remote access in services, it probably is disabled. Then goto a command prompt and issue a arp -a to see your cache, use arp -a <IP> for that machine mac address.

edited Apr 10 '15 at 15:20

Andrew Schulman

8,561
21
31
47

answered Apr 10 '15 at 12:19

ChrisW

21
2

Sorry, what do you mean by "what is above"? If you're referring to another answer, please be more specific since your answer may appear by itself or in a different order. – Andrew Schulman Apr 10 '15 at 15:19
1

Just look at the lengths to which this topic goes. All that is needed is arp -a and AHAW responded with code. while nice just over complicated. – ChrisW Apr 10 '15 at 17:28
My point is just that "above" is meaningless when your answer may appear by itself, or in an unknown order with other answers. Please be more specific. – Andrew Schulman Apr 10 '15 at 17:53

score 1 · Answer 8 · edited Feb 19 '14 at 00:23

1

You could try this :

nbtstat -A 192.168.2.41

You will get the remote mac address in the (pretty verbose) generated response.

edited Feb 19 '14 at 00:23

krisFR

12,830
3
31
40

answered Feb 17 '14 at 11:33

ADieuNePlaise

11
1

Knight · Answer 9 · 2019-07-11T15:52:31.803

1

I know question was for none domain systems however for those that may stumble on this looking for domain computer examples below is a quick and easy way to do it.

in windows you can just do the following

    $c = "computername" 
    Invoke-Command -ComputerName $c -ScriptBlock {

    getmac 
    }

simply runs a basic command prompt command on a remote system and returns the data.

edited Jul 11 '19 at 15:52

answered Jul 11 '19 at 15:46

Knight

11
2

Hackoo · Answer 10 · 2021-01-05T10:26:30.913

Suppose that you a have the inputfile with computers or ip address list, you can give a try with batch file :

@echo off
Set "Copyright=by Hackoo 2021"
Title Get IP and MAC address for remote PCs over the network using batch %Copyright%
Mode con cols=90 lines=12
cls & color 0A & echo.
echo     ********************************************************************************
echo         Get IP and MAC address for remote PCs over the network %Copyright%
echo     ********************************************************************************
echo(
if _%1_==_Main_  goto :Main
:getadmin
    echo            %~nx0 : self elevating
    set vbs=%temp%\getadmin.vbs
(
    echo Set UAC = CreateObject^("Shell.Application"^)
    echo UAC.ShellExecute "%~s0", "Main %~sdp0 %*", "", "runas", 1
)> "%vbs%"
    "%temp%\getadmin.vbs"
    del "%temp%\getadmin.vbs"
goto :eof
::-------------------------------------------------------------------------------------
:Main
set "InputFile=%~dp0Hosts.txt"
set "OutPutFile=%~dp0IP-MAC.txt"
If Exist "%OutPutFile%" Del "%OutPutFile%"

If Not Exist "%InputFile%" ( 
    color 0C & echo "%InputFile%" does not exist. Please check it first ! 
    Timeout /T 8 /NoBreak>nul & Exit
)

Netsh interface ip delete arpcache >nul 2>&1

@for /f "tokens=* delims=" %%H in ('Type "%InputFile%"') do (
    Ping -n 1 %%H>nul
    @for /f "tokens=2" %%M in ('arp -a %%H ^| find "%%H"') do (
        echo %%H : %%M
        echo %%H : %%M>>"%OutPutFile%"
    )
)
If Exist "%OutPutFile%" Start "" "%OutPutFile%" & Timeout /T 1 /NoBreak>nul & Exit
::-------------------------------------------------------------------------------------

Jaro · Answer 11 · 2015-09-17T21:27:22.433

0

"nmap -v -A [host name/IP address]" might be your best choice; UNIX OS for the client might have it natively available; but nmap is also available for Windows clients as well...

edited Sep 17 '15 at 21:27

answered Sep 17 '15 at 21:17

Jaro

5
4

The catch with nbtstat is that it only works for remote Windows machines - not 100% sure; it also requires some digging on the command syntax as well... – Jaro Sep 17 '15 at 21:32
Also, the "getmac /s [hostname/IP] can be used only on those remote Windows targets that have RPC enabled, are available to you remotely, and you also have remote admin rights on the system. – Jaro Sep 17 '15 at 21:35
Some other network scanners (Nessus, Nexpose, Metasploit) might also be able to report this data for you as well... – Jaro Sep 17 '15 at 21:36
Welcome to server fault! If you want, you can edit your answer after you create it to add additional content - this looks a lot better than comments. – Falcon Momot Sep 17 '15 at 23:44

how to get MAC address of remote computer

11 Answers11