In order to obtain a MAC address, you have to listen to specific type of network traffic, for example the ARP messages. MAC addresses are not included in all network packets. We listened network traffic on the TCP/IP protocol. We have chosen Linux (UBUNTU) platform and the tcpdump utility. How can I discover a MAC address from network traffic?Īs with anything in the IT industry, there are many ways to sniff network traffic and analyze its content. We can get information about IP addresses and MAC addresses by simply listening to network traffic and analyzing its content. Depending on the protocol and packet type, packet headers include information about the type of protocol that is used to transmit the data, length of packet, flags, and among others also IP addresses and MAC addresses. But, packet headers are not encrypted in most cases. This is the part that contains your data and is safe.

The data section of a packet can be encrypted with WEP, WPA, or some other mechanism. When data is transmitted over the network, it is organized in so-called packets or datagrams. Every network packet includes two parts: Let's prove it! Unencrypted information sent over encrypted protocols?Įveryone talks about WEP, WPA, WPA2, WPA-PSK, and others so you might be misled and thinking that if your network is WEP or WPA protected, all your data is encrypted. Information not being encrypted is the key knowledge here, and this is true even with WEP and WPA encryption standards. On both pages referenced above, the Wireless security: MAC addressing and How to break MAC filtering, we claimed that information about MAC addresses and IP addresses is not encrypted when the wireless access point sends data to connected devices and receives it back. ' How can I get a MAC address or an IP address from simple listening to network traffic?'

' H ow do those utilities get the MAC address?' or someone that is already using the wireless network that we are trying to break into). On this page, we used some utilities that provided us with the MAC address of an already authenticated client (i.e. We write about this on the How to break MAC filtering (wifi security) page. We took our explanation to the next level by providing also one other analysis in which we attempted to break MAC filtering. The Wireless security: MAC addressing article describes what MAC addressing is and how it works. This page relates to the security concept called MAC addressing or MAC filtering which we described in more details on the following page: Wireless security: MAC addressing.

Get mac address from ip linux