How to Find IP Address From MAC Address on Cisco Devices

Troubleshooting a network requires many different investigative skills, tools, and methodologies.  One procedure that is particularly useful when investigating various network problems is being able to determine the IP address of a host on the network when given only its MAC address. 

In this article we’ll take a look at how to find an IP address from a MAC address on a Cisco-based network.

Troubleshooting Circumstances

Initially, you may wonder, why would we want to be able to determine this?  If you have access to a host, you can simply use the ipconfig (Windows) or the ifconfig (Linux) command to find both the local IP address and the corresponding MAC address. 

However, there are situations in which you may need to find the IP address that corresponds to a particular MAC address without actually knowing which physical device that MAC address belongs to. 

The only information you may have is simply that the particular MAC address in question belongs to a device that is somewhere on your network.

To achieve this, you will need some techniques that can be used on Cisco routers and switches to zero in on that particular host, and determine what its IP address is, and that’s what we’ll be describing in this article.

Why Do You Need to Find an IP From a MAC Address?

Before we actually take a look at the techniques, let’s take a closer look at why you may be required to perform such a task.  Some of the scenarios where it would be helpful to find the IP address that corresponds to a particular MAC address include:

• Resolving Network Connectivity Issues: If you’re experiencing network connectivity issues, you may need to identify the IP address that corresponds to a specific MAC address to troubleshoot the problem. This can be helpful when you observe MAC address flapping, which may potentially indicate one of several network-related issues such as layer 2 loops or a misconfiguration of QinQ for example.
• Network Security: You may need to find the IP address that corresponds to a MAC address to identify potential security threats on your network. In situations such as VLAN hopping, man in the middle attacks, or even when port security is applied, performing this action can help you determine whether a particular device is authorized to connect to the network or if an unauthorized device is attempting to gain access.
• Troubleshooting services including DHCP: Network administrators may need to track and troubleshoot the performance of services such as DHCP that allocate IP addresses to particular devices. These allocations are performed based on MAC addresses.

Methodology

There are several protocols and technologies that are involved in the process of determining the IP address that corresponds to a particular MAC address.  The two primary technologies are Address Resolution Protocol (ARP) and Dynamic Host Configuration Protocol (DHCP).

Finding the MAC Address

Before going into how we find the IP address, let’s take a brief look at how we get the original MAC address in the first place. 

Of course you can do so if you have access to the device in question, such as a PC or a laptop.  However, you would typically use the “show mac-address-table” command on a Cisco switch. 

The output of this command shows a list of MAC addresses and the interfaces on which those MAC addresses have appeared. 

Once you find the MAC address that you’re looking for, you can then proceed to determine the corresponding IP address.

Using ARP on a Router Device

ARP maintains a construct within each network device called the ARP table.  Also known as an ARP cache, it contains the mappings of IP addresses to their corresponding MAC addresses.  During a device’s communication on the network, the APR table is populated using information received from ARP requests. 

It is possible to view the ARP table of a device such as a router or a switch by issuing the following command in the Cisco IOS CLI:

Router#show arp

This command will output the entire ARP table contained within the device at that moment.  Output may be similar to the following:

Protocol  Address          Age (min)  Hardware Addr   Type   Interface

Internet  10.1.1.1               5   0011.2233.4455  ARPA   GigabitEthernet0/1

Internet  10.1.1.2              11   000c.29c5.c290  ARPA   GigabitEthernet0/1

Internet  10.1.1.3              22   00a1.1234.5678  ARPA   GigabitEthernet0/1

Note that for each IP address there is a corresponding Hardware Address which is the MAC address.  If you have a large network, the output of such a command may be very large.  If you want to search for a specific MAC address, you can use the pipe character “|” to filter the output like so:

Router#show arp | include <MAC address>

In the above command, replace <MAC address> with the MAC address you want to look up.  For example, if you have a MAC address of 00:11:22:33:44:55, use the following command:

Router#show arp | include 0011.2233.4455

Keep in mind that the MAC address must be in the correct format that is used by the Cisco CLI which is three groups of four hexadecimal digits separated by periods for the command to work. 

The command has many additional keywords that can be used including the particular interface on which the ARP information was received, the VRF name as well as the type of ARP entry you are looking for.

The above commands are the same for Cisco routers and switches.  You can find out more details about them at this Cisco CLI command reference.

Caveats

Keep in mind that you can use this method to find the IP address that corresponds to a MAC address only under the following conditions:

• The device on which you are connected must have communicated directly with the host to which the MAC address belongs within the last 4 hours, which is the timeout for a Cisco devices ARP table entry.
• A switch or router that has served transient traffic of the host in question will not have populated its ARP table with the MAC and IP addresses you are looking for. The device must be the destination of related traffic to have done so.
• The switch or router on which you issue this command must have at least one interface connected to the network segment on which that MAC address in question must reside. This is the case because MAC addresses are only significant with the local network segment. 
• Proxy ARP may cause the local gateway (router) to respond to an ARP request with its own MAC address on behalf of the “real” host that owns the address, resulting in an incorrect assumption of the MAC to IP address mapping.

Using DHCP

If you’re using DHCP to assign IP addresses on your network, you can use the DHCP server to determine the IP address that corresponds to a particular MAC address. If your DHCP server is running on a Cisco device, here’s how you can use it to determine the IP address from a particular MAC.

Unlike ARP, DHCP actually assigns the IP addresses to particular hosts.  As such, it maintains a correspondence between the assigned IP address and the MAC address of each host.  Here’s how.

Log in to the Cisco device running the DHCP server and issue the following command:

Router#show ip dhcp binding

This command will list all of the DHCP leases that the server has assigned and includes the IP address, MAC address, and the lease expiration.  The output of such a command looks like this:

Router#show ip dhcp binding

IP address       Hardware address        Lease expiration        Type

172.25.1.51      0100.0103.85e9.87       Apr 10 2022 08:55 PM    Automatic

172.25.1.52      0100.50da.2a5e.a2       Apr 10 2022 09:00 PM    Automatic

172.25.1.53      0100.0103.ea1b.ed       Apr 10 2022 08:58 PM    Automatic

Similar to the ARP commands, if you want to search for a specific MAC address, you can use the pipe character “|” to filter the output.  More about this command and its variations can be found at this Cisco CLI command reference.

Unlike the use of the ARP table, this method gives you information not only about hosts that may be connected to local network segments, but about all hosts on your network that are served by this particular DHCP server.

Caveats

Note that the DHCP server only knows about devices that have requested an IP address from it, so the MAC address you’re interested in must have made a DHCP request at some point for this method to work.

Additionally, keep in mind that the lease duration determines how long an IP address is assigned to a device. After the lease expires, the IP address may be released back to the pool and assigned to another device.

If the lease has expired for the MAC address you’re interested in, it may not appear in the DHCP server’s lease list anymore, and you’ll need to use another method to determine the corresponding IP address.

How About IPv6

The above methods are geared towards finding the IPv4 address in any given situations.  To find the IPv6 address, some additional tools are necessary including DHCPv6, SLAAC, and Neighbor Discovery Protocol (NDP) and their related commands. Many of the principles are the same, but the tools used as well as the CLI syntax is different.

Conclusion

Finding the IP address that corresponds to a MAC address on a Cisco network can be an essential troubleshooting step in resolving network issues.

ARP and DHCP are crucial mechanisms that can be used to determine these IP addresses.  By understanding these methods and knowing how to use them effectively, network administrators can more quickly and efficiently troubleshoot network issues and ensure their network runs smoothly.