While trying to reconstruct the list of DHCP Reservations after a disaster, I needed a way to determine the MAC addresses of a bunch of headless servers. Yes, I could have logged in to each one remotely, or even dragged a display to each of the machines, but I am lazy. Now you can be too! Here’s how:

Ping each of the machines you want the MAC addresses for:

hostess:~ bigtone$ ping server1.example.com
PING server1.example.com (192.168.1.45): 56 data bytes
64 bytes from 192.168.1.45: icmp_seq=0 ttl=127 time=18.892 ms
...
hostess:~ bigtone$ ping server2.example.com
PING server2.example.com (192.168.1.55): 56 data bytes
64 bytes from 192.168.1.55: icmp_seq=0 ttl=127 time=13.294 ms
...
hostess:~ bigtone$ ping server3.example.com
PING server1.example.com (192.168.1.65): 56 data bytes
64 bytes from 192.168.1.65: icmp_seq=0 ttl=127 time=16.921 ms
...

Then, it’s ARP to the rescue:

hostess:~ bigtone$ arp -a
server3.example.com (192.168.123.65) at 00:AA:11:BB:33:CC [ether] on eth0
server2.example.com (192.168.123.55) at 00:BB:33:DD:55:FF [ether] on eth0
server1.example.com (192.168.123.45) at 00:E0:D1:C2:B3:A4 [ether] on eth0
...

Woot! Look at that list completely made up MAC addresses.

A couple of caveats, though:

• Results will be slightly different depending on what OS you run this from.
• The ARP cache is limited, so don’t ping a hundred hosts and expect to see them all when you run arp -a
• As far as I know, this will only work for machines on your local network. If there’s a router in the middle somewhere, you’ll get the routers MAC returned, and that’s probably not what you want.