Wolfgang Sommergut
Latest posts by Wolfgang Sommergut (see all)
- How to install PowerShell 7 on Windows and Linux - Mon, Oct 14 2019
- Configuring Windows Sandbox (network, mapped folders, and startup scripts) using a free GUI tool - Tue, Oct 8 2019
- Manage Internet Information Services (IIS) using Windows Admin Center (WAC) - Fri, Sep 27 2019
In most cases, you will want to import the MAC address of a NIC into the management console of an application. GUI tools such as msinfo32.exe are not practical for this task, so the command line is usually the better option.
ipconfig: often recommended but unsuitable ^
In most blogs and forums, ipconfig is recommended for reading the MAC address. To display the MAC address, you have to use the parameter /all, which spits out a clutter of information. This is particularly true if your machine contains multiple (virtual) adapters. To shorten the search results, you should use a filter:
1 | ipconfig /all|findstr /V 00-00-00|findstr Physical |
The first call of findstr removes all lines with empty MAC addresses. The second call finds all remaining lines with the IDs. Using ipconfig is cumbersome and is not an option if you have to read the MAC addresses remotely.
getmac: built for this purpose ^
The built-in Windows tool getmac is the perfect choice for this purpose. It is easy to use, supports remote queries, and can display results in a structured format:
1 | getmac /s 192.168.23.214 /fo csv /v |
In this example, the MAC address of the PC with the IP 192.168.23.214 is displayed in CSV format (parameter /fo csv) and in verbose mode (/v). You could redirect the output to a file and then store it in an environment variable with the setx command.
Remote access to the PC will only work if its firewall is configured to allow inbound WMI queries. If you receive the error message “Access denied,” you can configure the firewall with the following command:
netsh advfirewall firewall set rule group="windows management instrumentation (wmi)" new enable=yes.
wmic: read NIC properties ^
wmic is a pretty spartan client for WMI queries. It also supports reading the MAC address through the alias NIC:
1 | wmic /node:192.168.23.214 NIC get description,macaddress |
This query extracts the description and the MAC address from the extensive information that WMI provides about the adapter. Other useful attributes that you could retrieve with wmic are “manufacturer” or “productname.”
The advantage of wmic over other tools is that you can access exactly the information you require. For example, if you only need the MAC addresses of the physical adapters and not those of the numerous virtual adapters, you could run the following query:
1 | wmic /node:192.168.23.216 NIC where PhysicalAdapter='true' get description,macaddress |
Here, too, note that the firewall on the remote computer must allow WMI queries.
arp: find MAC address of an IP address ^
The main purpose of the Address Resolution Protocol (ARP) is to resolve the MAC address for a specific IP address. The MAC address is required if an IPv4 packet has to be encapsulated into an Ethernet frame. You can use this fact by first connecting to a remote computer and read the MAC address afterwards with the arp command. For this purpose, a simple ping is enough to find the machine in the arp list:
1 2 | ping -4 192.168.23.216 arp -a 192.168.23.216 |
You can’t format the arp output as you can with getmac or wmic; however, the output is easy to read because it only contains the essential information. The main advantage of arp compared to the WMI-based tools is that you don’t have to configure the firewall on the target computer.
Win the monthly 4sysops member prize for IT pros
Nice article. I have never run across the getmac command, so that was a bit of a revelation. I had always used arp -a, however it has some several limitations. Since ARP functions at layer 2, you have to be on the same subnet for it to work.
Good !!
Very useful. Thanks for sharing
Appreciate the post, as I didn't know about getmac either.
Is there a more generic mechanism, for systems other than Windows? ping then arp works for local machines, as the commenter timestride says, but that's the only of the bunch that works with non-Windows machines.
Also, is getmac using WMI?
Good job.....Very useful. Thanks for sharing
Although the MAC address is burned into the card at the time of manufacturing, some network cards allow their MAC addresses to be arbitrarily set through the device driver software. MAC addresses should not be relied upon solely for access control filtering and MAC address spoofing is a well-known security risk.
More about WMIC Commands
http://net-informations.com/q/mis/wmic.html
George
Hi, is there any way to check if device is connected to the network, when you know only MAC address? In case no device IP set, so it is unknown.