Finding MAC and IP addresses across subnets
A scan of your own subnet shows every device’s MAC address, but a scan of another subnet usually does not. This article explains why, and how Network Scanner and Switch Port Mapper can still match MAC and IP addresses beyond a router.
Why MAC addresses stop at the router
Computers find each other’s MAC addresses with ARP (Address Resolution Protocol). ARP works only within one subnet: routers do not pass ARP messages from one subnet to another. When you scan a different subnet, the only MAC address ARP can find for those devices is the router’s own, so other ways are needed.
The router itself, however, sits between the subnets and knows the MAC addresses of the devices on each side. Many routers can share that table over SNMP, and that is the most reliable way to get MAC addresses from other subnets.
Network Scanner
Press Ctrl+O to open the options, and go to the Additional tab. Under Resolve MAC addresses there are four methods. Tick the ones you want and drag them into the order they should be tried in; double-click a method to change its settings.
- ARP query always works in the local subnet, but not across a router. If your router supports proxy ARP, ticking Allow ARP outside current subnet on the General tab may find more.
- NetBIOS query works in any subnet, but only devices that answer NetBIOS, mostly Windows computers, report their MAC address this way.
- WMI query (Windows only) reads the MAC address from each Windows computer’s network settings. It needs administrative rights on those computers, for example a domain administrator account.
- Router MIB query reads the router’s table of IP and MAC addresses over SNMP before the scan starts, so it works for every device the router knows, on any of its subnets.
For devices behind a router, tick NetBIOS query and Router MIB query and move them to the top.
Setting up the router MIB query
The router must have SNMP enabled and support at least one of these standard tables, as most SNMP-capable routers do:
- ipNetToPhysicalTable (1.3.6.1.2.1.4.35)
- ipNetToMediaTable (1.3.6.1.2.1.4.22)
- atTable (1.3.6.1.2.1.3.1)
Double-click Router MIB query to open its settings:
- Community string (one or more): the router’s SNMPv1 or SNMPv2c read community, which works like a password. Separate several with commas.
- Include default gateways: when True, the computer’s default gateways are queried, which is usually the router you need.
- Additional router IP addresses: any other routers to query, separated by commas.
- Add SNMPv3 account: for a router that uses SNMPv3, add its user name and passwords here.
Network Scanner then reads the routers’ tables before scanning, and shows the MAC address of every device found in them.
Switch Port Mapper
A switch reports which MAC addresses are connected to each of its ports, but nothing about IP addresses, and a MAC address alone cannot be turned into an IP address. To show IP addresses and host names, Switch Port Mapper needs a table that matches the two, and it gets one in either of two ways:
- From the router. When you add a switch in Actions – Manage Devices, enter the router’s details beside the switch’s. Port Mapper then reads the router’s table of IP and MAC addresses over SNMP. This works for any subnet the router serves.
- By scanning. If no router is set, or it returns no addresses, and Scan the current subnet for MAC-to-IP address mappings is ticked on the Discovery page of File – Settings, Port Mapper scans the network itself. Because it relies on ARP, this only works for devices in the computer’s own subnet.
Port Mapper then looks up a host name for each IP address. A port whose MAC address is in neither table shows only the MAC address.