Solved How to retrieve IP addresss of ssh server

How to I find the IP address of an ssh server with a known MAC address?

nmap can find all the ssh servers on a subnet and will provide MAC addresses for each server, but how do I find a particular server with a known MAC address?
 
Wrong tool!


arp -a | grep -i '00:23:24:64:BF:CD'

Does the job... just need to extract the IP address....

Can I use cut() with -d '(' and -d ')'
 
Code:
arp -a | grep -i '00:23:24:64:BF:CD' | awk -F'[()]' '{print $2}'

Or, if you want to explicitly extract an IP address
Code:
arp -a | grep -i '00:23:24:64:BF:CD' | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'
 
Code:
arp -a | sed -n 's/.*(\(.*\)).*aa:bb:cc:dd:ee:ff.*/\1/p'
where aa:bb:cc:dd:ee:ff is your MAC address.

Many thanks for this. It's what I would have come up with if I had sufficient mental agility.

I'm a big fan of sed () and will study your excellent script to try and understand how it works. At the moment my eyes just glaze over trying to figure out how it does what it does.
 
nmap can also tell you the IP address (and much more, e.g. hostname) of any host that runs ssh, just use the proper scan type and options:
nmap -PS22 192.168.0.0/24
 
nmap can also tell you the IP address (and much more, e.g. hostname) of any host that runs ssh, just use the proper scan type and options:
nmap -PS22 192.168.0.0/24
The problem is that you may get a list of IP addresses but you won't know which one is the one you want to access without further checks. If you have the MAC address it's more straightforward if you use arp().
 
If you have the MAC address it's more straightforward if you use arp().
If you have managed switches you can even lookup on which port the host is connected by looking at the switch's tables.

Note that with ARP you can only look up in your local subnet (broadcast domain). If the SSH server is behind a router you will only see the router's MAC address.
 
Back
Top