IP to MAC Lookup

About IP to MAC Lookup

An ordinary IPv4 address has no MAC address inside it. The network hands the address out; the MAC belongs to the hardware. The only record of which device answered for which address is the ARP table each machine keeps — so for a unicast IPv4 address, paste that table (arp -a, ip neigh, or a switch's show ip arp) and the MAC recorded for the address is found in it.

Some addresses do map to a MAC by rule, and those are computed exactly. An IPv4 multicast group maps to 01:00:5E followed by the low 23 bits of the group (RFC 1112) — so 224.0.0.251, the mDNS group, is always 01:00:5E:00:00:FB. An IPv6 multicast group maps to 33:33 followed by its low 32 bits (RFC 2464). The broadcast address is always FF:FF:FF:FF:FF:FF. And an IPv6 address formed with SLAAC's modified EUI-64 carries the device's MAC in its interface identifier.

Every MAC found is named with its manufacturer from the IEEE registry. When a table records more than one MAC for the same IP, that is flagged: it means two devices are using one address, a failover pair moved it, or something is answering ARP for an address that is not its own.

Everything runs in this browser. The address and the table you paste are not sent anywhere.

Where it helps

• Computes the MAC exactly for IPv4 and IPv6 multicast, broadcast and EUI-64 addresses, with no table needed.
• Reads macOS, Windows and Linux ARP tables, ip neigh, and Cisco show ip arp output as pasted.
• Names the manufacturer of every MAC it finds.
• Flags an IP that more than one MAC answered for: an address conflict or ARP spoofing.
• Runs in the browser: no address or table leaves the page.

Limits

• A unicast IPv4 address cannot be resolved without a table: the mapping exists only on the network.
• The table has to come from a machine on the same local network as the device; routers replace the MAC at every hop.
• ARP entries expire after a few minutes of silence. Ping the device first, then copy the table.
• A device with a randomised Wi-Fi address will show that address, not its hardware MAC.

Frequently asked questions

How do I find the MAC address of an IP address?

From a machine on the same network, ping the IP so it answers, then run arp -a (Windows, macOS) or ip neigh (Linux) and look for the address — or paste the output here. Your router's list of DHCP clients shows the same pairing for devices it handed addresses to.

Can I find the MAC address of a device on the internet?

No. A MAC address only travels as far as the first router: every hop replaces it with its own. From outside a network you can only ever see the MAC of the last router before you.

Why does a multicast IP have a MAC address?

So that network cards can filter multicast traffic in hardware. RFC 1112 reserves 01:00:5E for IPv4 groups and puts the low 23 bits of the group address after it; IPv6 uses 33:33 and the low 32 bits. Because 5 bits are dropped, 32 IPv4 groups share each MAC.

What does it mean when two MAC addresses have the same IP?

Two devices are answering for one address. It is usually a configuration mistake — a static address that clashes with DHCP — or a failover pair that moved it, but it is also what ARP spoofing looks like, where a machine claims another's address to intercept its traffic.

Related tools

• MAC to IP Converter — Build the IPv6 address a MAC forms with SLAAC, recover the MAC from one, or find a MAC's IP in an ARP table
• MAC Address Lookup — Find the manufacturer behind a MAC address, and see what kind of address it is
• IP Address Converter — Write an IPv4 or IPv6 address as an integer, hex, binary, expanded or mapped form, and see what kind it is
• What Is My IP — Your public address, and what a browser reveals about you
• DNS Lookup — Resolve A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records
• IP Lookup — Resolve addresses and reverse DNS for a host or IP

More Network & DNS tools

• DNS Lookup — Resolve A, AAAA, MX, TXT, NS, CNAME, SOA and CAA records
• IP Lookup — Resolve addresses and reverse DNS for a host or IP
• Port Checker — Test whether TCP ports accept connections
• Nmap Port Scanner — Scan a host's common TCP ports, Nmap style, and see what each open service says it is
• Ping (TCP) — Measure connection latency with repeated TCP probes
• What Is My IP — Your public address, and what a browser reveals about you
• WHOIS — Registry records for a domain, an IP address or an AS number
• DNS Propagation Checker — The same name asked of resolvers worldwide, and of the zone's own servers
• Email Authentication Checker — SPF, DKIM, DMARC and MX for a domain, read together
• Email Header Analyzer — The delivery path, the authentication results, and what a forgery looks like
• DKIM Lookup — A domain's DKIM keys, for a selector or by trying the common ones, and whether each is worth anything
• DMARC Lookup — A domain's DMARC policy, and what it actually asks receivers to do
• Reverse DNS Lookup — The PTR record for an address, and whether it confirms itself
• IP Blacklist Checker — Whether an address is on the blocklists that actually stop mail
• Reverse IP Lookup — What an address says about itself: its name, its certificate, its network
• Traceroute — Every hop between this server and a host, with the time each one took
• Broadband Speed Test — Download, upload, latency and jitter, measured from this tab
• HTTP Headers — Grade a site's security headers from A+ to F, see every response header, and get the fix for your server
• Redirect Checker — Follow a URL's redirects hop by hop, and flag loops, downgrades and temporary redirects doing a permanent job
• IP Address Converter — Write an IPv4 or IPv6 address as an integer, hex, binary, expanded or mapped form, and see what kind it is
• MAC Address Lookup — Find the manufacturer behind a MAC address, and see what kind of address it is
• MAC to IP Converter — Build the IPv6 address a MAC forms with SLAAC, recover the MAC from one, or find a MAC's IP in an ARP table
• DNSSEC Checker — Whether a domain's DNSSEC validates, and if not, whether it is the DS, a key, an algorithm or an expired signature