Solved How to retrieve IP addresss of ssh server

[balanga]

How to I find the IP address of an ssh server with a known MAC address?

nmap can find all the ssh servers on a subnet and will provide MAC addresses for each server, but how do I find a particular server with a known MAC address?

 

[balanga]

Wrong tool!


arp -a | grep -i '00:23:24:64:BF:CD'

Does the job... just need to extract the IP address....

Can I use cut() with -d '(' and -d ')'

 

[gpw928]

The typical lifetime of an ARP entry is 2 minutes, but much longer lifetimes (up to 20 minutes) have been observed.

So the arp cache may, or may not, identify all the IP addresses on the subnet.

net-mgmt/arpwatch may be of interest.

 

[aragats]

Can I use cut() with -d '(' and -d ')'

arp -a | sed -n 's/.*(\(.*\)).*aa:bb:cc:dd:ee:ff.*/\1/p'

where aa:bb:cc:dd:ee:ff is your MAC address.

 

[gpatrick]

arp -a | grep -i '00:23:24:64:BF:CD' | awk -F'[()]' '{print $2}'

Or, if you want to explicitly extract an IP address

arp -a | grep -i '00:23:24:64:BF:CD' | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'

 

[balanga]

arp -a | sed -n 's/.*(\(.*\)).*aa:bb:cc:dd:ee:ff.*/\1/p'

where aa:bb:cc:dd:ee:ff is your MAC address.

Many thanks for this. It's what I would have come up with if I had sufficient mental agility.

I'm a big fan of sed () and will study your excellent script to try and understand how it works. At the moment my eyes just glaze over trying to figure out how it does what it does.

 

[sko]

nmap can also tell you the IP address (and much more, e.g. hostname) of any host that runs ssh, just use the proper scan type and options:
nmap -PS22 192.168.0.0/24

 

[balanga]

nmap can also tell you the IP address (and much more, e.g. hostname) of any host that runs ssh, just use the proper scan type and options:
nmap -PS22 192.168.0.0/24

The problem is that you may get a list of IP addresses but you won't know which one is the one you want to access without further checks. If you have the MAC address it's more straightforward if you use arp().

 

[SirDice]

If you have the MAC address it's more straightforward if you use arp().

If you have managed switches you can even lookup on which port the host is connected by looking at the switch's tables.

Note that with ARP you can only look up in your local subnet (broadcast domain). If the SSH server is behind a router you will only see the router's MAC address.

 

[balanga]

arp -a | sed -n 's/.*(\(.*\)).*aa:bb:cc:dd:ee:ff.*/\1/p'

where aa:bb:cc:dd:ee:ff is your MAC address.

I know this works but can't figure out how.

Can someone explain the black magic behind this:-

.*(\(.*\)).*

and how does '\1' translate?

 

[aragats]

\1 stands for the first expression in parenthesis, \2 for the second and so on.
In this particular case: the unescaped parenthesis are the literal parenthesis coming from arp's output. All characters between the escaped parenthesis are reproduced by \1 in the sed's output.