Get IP with just knowing MAC address - windows

I'm trying to write a batch file, that gives me an IP back, but I just know the MAC address
arp -a
wont work for me, because I never pinged that IP before. I want to search for it in the network with literally just knowing the MAC address.
Information: The IP is static.

Assuming, your subnet is 192.168.1.xxx
#echo off
REM clear arp cache (optional):
arp -d
REM ask everybody on the subnet for a response:
for /l %%a in (1,1,255) do start /b ping -n 2 -w 500 192.168.1.%%a >nul
REM wait for the processes to finish:
timeout 2 >nul
REM show the responses (with IP and MAC):
arp -a
When you found the IP, you can try to resolve the computer name with:
ping -a -n 1 192.168.1.xxx
Edit found a way to speed it up.

Edit : just realized you where on Windows. Sadly, there is no native way to ping on braodcast addresses with Windows, but you can use the trick from this answer : FOR /L %i in (1,1,255) do #ping -n 1 192.168.1.%i | find "Reply". It seems super slow though.
Previous answer is below.
As far as I know, you have to fill in your ARP cache to do what you want.
This answer is what you need.
As the post says, you can :
ping all hosts of your LAN by pinging your broadcast address (ping -b -c1 192.168.1.255, replace the IP by your actual broadcast address)
fping your whole network (fping -a -g 192.168.1.0/24, replace with your actual netmask)
nmap the network (nmap -sP 192.168.1.0/24)
nbtscan (windows hosts only, nbtscan 192.168.1.0/24)
And then look up in your ARP cache.

for /f "skip=3 delims=\" %%A in ('net view ^| findstr /v /C:"The command completed successfully"') do Echo %%A >> "%userprofile%\desktop\computerlist.txt"
Lists turned on computers.
wmic /node:#computerlist.txt nicconfig where macaddress='whatever:whatever:etc' get ipaddress /format:htable
To get IP for a specified MACAddress
wmic /node:#computerlist.txt nicconfig get ipaddress /format:htable
to get the IPAddress for all MACAddresses on a computer.

I remember that sachadee posted this code ScanIP-MAC.bat
#echo off
Title Scan for IP and MAC Adress on LAN
mode con cols=60 lines=20
Color A
set ip=192.168.1.1
set debut=1
set fin=10
if exist ping.txt (del ping.txt)
if exist ping2.txt (del ping2.txt)
if exist ping3.txt (del ping3.txt)
if exist ping4.txt (del ping4.txt)
for /L %%i in (%debut%,1,%fin%) do (echo Recherche de la machine : %ip:~0,9%.%%i
for /f "tokens=5 delims= " %%f in ('ping -4 -n 1 %ip:~0,9%.%%i ^|find /i "32"') do (echo %%f >> ping.txt
)
for /f "tokens=1 delims= " %%k in ('Type ping.txt ^|findstr /i "19"') do echo %%k > ping2.txt
for /f %%l in (ping2.txt) do (arp -a %%l >> ping3.txt
)
)
Cmd /U /C Type ping3.txt > ping4.txt
Del ping.txt
Del ping2.txt
Del ping3.txt
Start ping4.txt

I am not a batch user so i dont know the commands but i know the way to do this is sending broadcast ping request to ur network and check for the mac address from the reply's using wireshark.

Related

Adding names to an IP address without failing the batch file

I want to use a batch file to ping a set of servers. The batch file works and reports ok or failed. All I want is to have it display a name of the server in the check.
This is what I use in the batch file:
#echo off
for /f "delims=" %%a in (C:\List of IPs.txt) do ping -n 1 %%a >nul && (echo %%a ok) || (echo %%a failed to respond)
pause
In the text file it points to is just a list of IPs, how do I make it so I can see a name next to the IP?
Thank you in advance!
just insert another for /f loop to get the name:
#echo off
SetLocal
for /f "usebackq" %%a in ("List of IPs.txt") do (
for /f %%b in ('"ping -n 1 %%a >nul && (echo ok) || (echo failed to respond) "') do (
for /f "tokens=1*" %%m in ('nslookup %%a ^|findstr /b "Name:"') do (
echo %%a %%n %%b
)
)
)
One option is to format your file to have the IP and the name you are interested in.
192.168.1.200 server1
192.168.1.201 server2
192.168.1.202 printer1
192.168.1.203 that one stupid printer in the back
Then you can read both from the file.
One thing I'll note -- your method of checking pings is not consistent. You can get an errorlevel 0 even if the ping actually fails (from a valid response of "unreachable"). Instead (in English) a successful ping always includes "ttl=". Thus you would do this:
untested
#echo off
for /f "usebackq tokens=1* delims= " %%a in ("C:\List of IPs.txt") do ping -n 1 %%a ^|find /i "ttl=" >nul && (echo %%b at %%a is ok) || (echo %%b at %%a failed to respond)
pause
nslookup and/or ping -a can be leveraged if you have dns working with everything you're trying to access.
Based on comment, I've added the following solution that works on my English Windows 10 computer with the text file above:
#echo off
for /f "usebackq tokens=1* delims= " %%a in ("C:\temp\List of IPs.txt") do ping -n 1 -w 1500 %%a |find /i "ttl=" >nul &&echo %%b at %%a is ok||echo %%b at %%a failed to respond
pause
Note there is a space between the equal sign and the double quote at delims= "
Output:
server1 at 192.168.1.200 is ok
server2 at 192.168.1.201 is ok
printer1 at 192.168.1.202 is ok
that one stupid printer in the back at 192.168.1.203 failed to respond
Press any key to continue . . .

CMD: search IP's of devices with special MAC

I need to find IP of device or devices in local network. I only know that their MAC address should start with "xx-xx-xx-xx-". I found following script that do almost what I need:
#echo off
:top
:: Loop through arp table entries and look for my device's MAC address
for /f "tokens=1-5 skip=3" %%f in ('arp -a') do (
if "%%g"=="xx-xx-xx-xx-xx-xx" set ip=%%f
)
if "%ip%"=="" (
echo Discovering network...
:: Ping all IPs from 192.168.0.1 to 254
for /L %%N in (1,1,254) do start /b ping -n 1 -w 200 192.168.0.%%N >nul
timeout 1 >nul
goto :top
) else (
echo Device found found: %ip%
)
pause
But this script search only with full MAC and only one device. How make it search subMAC and several devices?
the following works for me:
#echo off
:top
:: Loop through arp table entries and look for my device's MAC address
set "ip="
for /f "tokens=2" %%f in ('arp -a^|find " d4-85-64"') do set ip=%%f
if "%ip%"=="" (
echo Discovering network...
:: Ping all IPs from 192.168.0.1 to 254
for /L %%N in (1,1,254) do start /b ping -n 1 -w 200 192.168.0.%%N >nul
timeout 1 >nul
goto :top
)
echo Device found: %ip%
pause
Changes:
set "ip=" to empty variable (in case, it already exists (from previous run))
removed skip (not needed),
set "tokens=2" (that's all, we need)
included find " xx-xx-xx" to search the desired line (with leading space for "start with") (of course I choosed a MAC existing in MY network)
moved success message out of if (not neccesary, but cleaner code)

How do I ping the default gateway without specifying the IP address?

I'm trying to write a batch file that tests network connectivity by pinging the default gateway of the given network.
However, as I want this to be an automated process which then logs the results to a text file, I'd like to be able to ping the gateway on various networks, without having to change/enter the ip address.
Is there a generic term or command to ping the default gateway for the network you're currently connected to?
(I already have the commands for output options etc.)
So far, I have this....
#echo off
goto :NETWORK1
:NETWORK1
ipconfig
echo .
Set /P gateway=PLEASE ENTER GATEWAY IP ADDRESS (shown above):
if /I "%gateway%" EQU "exit" goto :EXIT
if /I not "%gateway%" EQU "exit" goto :NETWORK2
:NETWORK2
echo CLOSING THIS WINDOW WILL ABORT THE CONNECTIVITY TEST.
echo . >> "C:\Network Test Results %date:/=.%.txt"
echo Time: >> "C:\Network Test Results %date:/=.%.txt"
time /t >> "C:\Network Test Results %date:/=.%.txt"
ping %gateway% -n 20 >> "C:\Network Test Results %date:/=.%.txt"
goto :NETWORK2
:EXIT
exit
But I don't want to have to specify the IP address, so that I can take away the need for user input.
smalll fix for Wernfried Domscheit
for /f "tokens=2 delims=:" %%g in ('netsh interface ip show address ^| findstr /c:"Default Gateway"') do ping %%g
pause
just adding /c: before "Default Gateway"
On a command line you can try this one:
for /f "tokens=2 delims=:" %g in ('netsh interface ip show address ^| findstr "Default Gateway"') do ping %g
Note, inside a batch-file you must double the %, i.e.
for /f "tokens=2 delims=:" %%g in ('netsh interface ip show address ^| findstr "Default Gateway"') do ping %%g
According to jimbobomcgee on serverfault who phrased the correct answer for the question How to Extract command-line output into a Variable?
for /f "usebackq tokens=1,2,3 delims=:" %A in (`ipconfig ^| Find "Default Gateway" ^| Findstr/N "." ^| Findstr/B "1:"`) do #if not defined MYVAR set MYVAR=%~C
#echo off
setlocal enableextensions disabledelayedexpansion
set "gateway="
for /f "tokens=1-5" %%a in ('route -4 print 0.*') do #if "%%e"=="" if "%%a"=="%%b" set "gateway=%%c"
if not defined gateway goto :eof
echo CLOSING THIS WINDOW WILL ABORT THE CONNECTIVITY TEST.
:loop
echo %date% %time%
>> "Network Test Results %date:/=.%.txt" (
echo(
echo(Time: %time%
ping -n 20 -4 %gateway%
)
goto :loop
Gateway determination from route information copied from here
edited for a more tolerant parse of the route command use
for /f "tokens=3" %%a in ('route -4 print 0.* ^| find "0."') do set "gateway=%%a"
After help from #MC ND, I have created the following code, which does exactly what I needed....
pings the default gateway with the results being output to a text file
shows a message telling the user not to close the command window
#echo off
setlocal enableextensions disabledelayedexpansion
for /f "tokens=3" %%a in ('route -4 print 0.*') do set "gateway=%%a"
:NETWORK
echo CLOSING THIS WINDOW WILL ABORT THE CONNECTIVITY TEST.
echo Time >> "C:\Network Test Results %date:/=.%.txt"
time /t >> "C:\Network Test Results %date:/=.%.txt"
echo . >> "C:\Network Test Results %date:/=.%.txt"
ping %gateway% -n 20 >> "C:\Network Test Results %date:/=.%.txt"
goto :NETWORK

Windows batch file - ipconfig / skype

I want that Skype only starts when I am connected on a specific LAN IP address.
#echo off
set ip_address_string="IPv4 Address"
for /f "usebackq tokens=2 delims=:" %%f in (`ipconfig ^| findstr /c:%ip_address_string%`) do echo bounded IP-address: %%f
But how can I realize that Skype only will be called if any ip address contains 64.2.4.*?
Moreover, the batch file will run every 5 minutes and if it is required the Skype-process should be killed.
#echo off
set "ip_address_string=64.2.4."
ipconfig | findstr /c:"%ip_address_string%" >nul|| (
echo IP "%ip_address_string%" not found.
taskkill /im skype.exe /f
exit /b 0
)
echo connected as/to "%ip_address_string%"
?

Ping all addresses in network, windows

Is it possible in windows cmd line to check all of the network addresses (with ping or similar) to see which ones are taken/ have active devices:
ie. something that does something like the following:
for i = 0 to 255
ping 192.168.1.i //Print this
end
This is psuedo code obviously. I am wondering if it is possible to do something like this in windows cmd. It would be great if you didn't need a batch file, but i understand if this is impossible.
PS. Also please mention if there is a program to do this, but it would be nice to do it in cmd.
Open the Command Prompt and type in the following:
FOR /L %i IN (1,1,254) DO ping -n 1 192.168.10.%i | FIND /i "Reply">>c:\ipaddresses.txt
Change 192.168.10 to match you own network.
By using -n 1 you are asking for only 1 packet to be sent to each computer instead of the usual 4 packets.
The above command will ping all IP Addresses on the 192.168.10.0 network and create a text document in the C:\ drive called ipaddresses.txt. This text document should only contain IP Addresses that replied to the ping request.
Although it will take quite a bit longer to complete, you can also resolve the IP Addresses to HOST names by simply adding -a to the ping command.
FOR /L %i IN (1,1,254) DO ping -a -n 1 192.168.10.%i | FIND /i "Reply">>c:\ipaddresses.txt
This is from Here
I know this is a late response, but a neat way of doing this is to ping the broadcast address which populates your local arp cache.
This can then be shown by running arp -a which will list all the addresses in you local arp table.
ping 192.168.1.255
arp -a
Hopefully this is a nice neat option that people can use.
Best Utility in terms of speed is Nmap.
write # cmd prompt:
Nmap -sn -oG ip.txt 192.168.1.1-255
this will just ping all the ip addresses in the range given and store it in simple text file
It takes just 2 secs to scan 255 hosts using Nmap.
Provided the windows box is in the same subnet:
for /L %a in (1,1,254) do start ping 192.168.0.%a
This will complete in less than 15 seconds and
arp -a
will return any alive host.
Fastest native way I know of in Windows.
This post asks the same question, but for linux - you may find it helpful. Send a ping to each IP on a subnet
nmap is probably the best tool to use, as it can help identify host OS as well as being faster. It is available for the windows platform on the nmap.org site
An expansion and useful addition to egmackenzie's "arp -a" solution for Windows -
Windows Example searching for my iPhone on the WiFi network
(pre: iPhone WiFi disabled)
Open Command Prompt in Admin mode (R.C. Start & look in menu)
arp -d <- clear the arp listing!
ping 10.1.10.255 <- take your subnet, and ping '255', everyone
arp -a
iPhone WiFi on
ping 10.1.10.255
arp -a
See below for example:
Here is a nice writeup on the use of 'arp -d' here if interested -
TechRepublic - Quick Tips Flush the ARP cache in Windows 7
All you are wanting to do is to see if computers are connected to the network and to gather their IP addresses. You can utilize angryIP scanner: http://angryip.org/ to see what IP addresses are in use on a particular subnet or groups of subnets.
I have found this tool very helpful when trying to see what IPs are being used that are not located inside of my DHCP.
Some things seem appeared to have changed in batch scripts on Windows 8, and the solution above by DGG now causes the Command Prompt to crash.
The following solution worked for me:
#echo off
set /a n=0
:repeat
set /a n+=1
echo 192.168.1.%n%
ping -n 1 -w 500 192.168.1.%n% | FIND /i "Reply">>ipaddresses.txt
if %n% lss 254 goto repeat
type ipaddresses.txt
aping can provide a list of hosts and whether each has responded to pings.
aping -show all 192.168.1.*
#ECHO OFF
IF "%SUBNET%"=="" SET SUBNET=10
:ARGUMENTS
ECHO SUBNET=%SUBNET%
ECHO ARGUMENT %1
IF "%1"=="SUM" GOTO SUM
IF "%1"=="SLOW" GOTO SLOW
IF "%1"=="ARP" GOTO ARP
IF "%1"=="FAST" GOTO FAST
REM PRINT ARP TABLE BY DEFAULT
:DEFAULT
ARP -a
GOTO END
REM METHOD 1 ADDRESS AT A TIME
:SLOW
ECHO START SCAN
ECHO %0 > ipaddresses.txt
DATE /T >> ipaddresses.txt
TIME /T >> ipaddresses.txt
FOR /L %%i IN (1,1,254) DO ping -a -n 2 192.168.%SUBNET%.%%i | FIND /i "TTL=" >> ipaddresses.txt
GOTO END
REM METHOD 2 MULTITASKING ALL ADDRESS AT SAME TIME
:FAST
ECHO START FAST SCANNING 192.168.%SUBNET%.X
set /a n=0
:FASTLOOP
set /a n+=1
ECHO 192.168.%SUBNET%.%n%
START CMD.exe /c call ipaddress.bat 192.168.%SUBNET%.%n%
IF %n% lss 254 GOTO FASTLOOP
GOTO END
:SUM
ECHO START SUM
ECHO %0 > ipaddresses.txt
DATE /T >> ipaddresses.txt
TIME /T >> ipaddresses.txt
FOR /L %%i IN (1,1,254) DO TYPE ip192.168.%SUBNET%.%%i.txt | FIND /i "TTL=" >> ipaddresses.txt
FOR /L %%i IN (1,1,254) DO DEL ip192.168.%SUBNET%.%%i.txt
type ipaddresses.txt
GOTO END
:ARP
ARP -a >> ipaddresses.txt
type ipaddresses.txt
GOTO END
:END
ECHO DONE WITH IP SCANNING
ECHO OPTION "%0 SLOW" FOR SCANNING 1 AT A TIME
ECHO OPTION "%0 SUM" FOR COMBINE ALL TO FILE
ECHO OPTION "%0 ARP" FOR ADD ARP - IP LIST
ECHO PARAMETER "SET SUBNET=X" FOR SUBNET
ECHO.
#echo off
if not "%1"=="am_admin" (powershell start -verb runas '%0' am_admin & exit /b)
arp -d
setlocal
setlocal enabledelayedexpansion
for /f "usebackq tokens=*" %%a in (`ipconfig ^| findstr /i "192"`) do (
for /f delims^=^:^ tokens^=2 %%b in ('echo %%a') do (
for /f "tokens=1-4 delims=." %%c in ("%%b") do (
set _o1=%%c
set _o2=%%d
set _o3=%%e
set _o4=%%f
set _3octet=!_o1:~1!.!_o2!.!_o3!.
for /L %%a in (1,1,254) do start /min ping /n 1 /l 1 !_3octet!%%a
)))
endlocal
After you run the batch file, type this command
arp -a
All devices connected to the network will be displayed
for /l %%a in (254, -1, 1) do (
for /l %%b in (1, 1, 254) do (
for %%c in (20, 168) do (
for %%e in (172, 192) do (
ping /n 1 %%e.%%c.%%b.%%a>>ping.txt
)
)
)
)
pause>nul

Resources