1

While trying to find MAC addresses of networked machines, two different methods were used and different answers were received:

  1. Ping the machine name using the command nbtstat -a xxx.xxx.xxx.xxx (x being the IP address); double checking that it is returning the same machine name as original ping.

  2. Physically go to a machine that is networked, and use the ipconfig/all command.

Why we would get two different results?

Karan
  • 56,477
Dana
  • 23
  • Did you ping the machine directly via the local network? (With no intermediate devices with their own MAC between you and the target). – Hennes Jan 17 '13 at 14:12
  • I did ping the machine using both the ip address and the machine name and verified it was returning the correct machine name. – Dana Jan 17 '13 at 14:53
  • Aye, but is there anything in between? E.g Your desktop -- router or switch -- laptop. In that case the router will have a MAC and pinging the laptop will result in traffic going from desktop (though the router and its MAC) to the laptop. – Hennes Jan 17 '13 at 15:07
  • Ahhh...so, by pinging the machine name, the doing nbtstat -a with ip address that's returned, I'm actually getting the MAC for the router or switch? – Dana Jan 17 '13 at 16:20
  • Yes. If the other computer is on the same network (e.g. same cable, or via a hub or unmannaged router) then your data is sent directly to it. In all other case your traffic is sent to a default gateway (basically a "Hi DG. I do not know how to sent this to the destination, can you handle it for me?" Depending on how that machine is configured you may see that machines MAC). – Hennes Jan 17 '13 at 16:28

1 Answers1

0

You are getting the macs - Media Access Control - of two different bits of hardware.

Your machines are invariably going to be connected via a switch connected to a router. The address you get from the machine is the mac of the network card or chip on the machine / laptop. Other mac is the one which your router returns having pinged an address assigned by the router?

Or do you have more than one network adaptor? If you have a wireless access card as well as the LAN card for example. "some computers have more than one MAC address. This is because MAC addresses are attached physically to the network adapter hardware and not to the base computer itself. Computers with multiple network adapters installed (sometimes called multihomed systems) therefore possess multiple unique MAC addresses."

"In some exceptional situations a single interface can have two MAC addresses, however this happens only if using something like a virtual mahine, where the virtual computer needs to share your ethernet port. To make sure that the packets go to the right place, the virtual machine will create its own MAC address."

offchaos
  • 31
  • Each of these machines have only 1 network card installed. The laptops do have wireless cards installed, but they have been docked and wired when the attempt was made to aquire the information. – Dana Jan 17 '13 at 14:55