MAC Address Lookups from Switch, ARP and DHCP Output

Start with the question

Decide whether you need to locate a device physically, connect an IP address to a local interface, identify an unexpected client, or enrich an inventory. That choice determines which network table should be authoritative.

Switch forwarding tables: where was it learned?

An Ethernet switch records source MAC addresses and the ports on which it learned them. Depending on the platform, commands may resemble show mac address-table, show ethernet-switching table or a bridge forwarding-database query.

VLAN   MAC address       Type       Port
120    00:1B:2C:3D:4E:5F dynamic    Gi1/0/18

This tells you that the address was seen in VLAN 120 on that port. It does not prove the device is directly attached. A trunk, downstream switch, access point, IP phone or virtualisation host can expose many learned addresses on one port. Check the interface description and whether the port is an access or trunk link.

ARP and neighbour tables: which local IP used it?

IPv4 ARP and IPv6 neighbour discovery map a network-layer address to a link-layer address on the same local segment. Router, firewall and host commands may resemble show arp, ip neigh, arp -a or Get-NetNeighbor.

192.0.2.42    00:1B:2C:3D:4E:5F    reachable    vlan120

The entry connects the observed MAC address to a local IP at a point in time. Entries age, devices change addresses and an IP may later be leased to somebody else. Capture timestamps and consult the correct routed interface.

For a remote destination, the local ARP cache normally contains the default gateway’s MAC address. MAC addresses are not carried end-to-end across routed networks, so an ARP entry cannot identify the hardware behind an arbitrary internet address.

DHCP leases: what did the client report?

A DHCP lease can add a hostname, client identifier, lease start and expiry time, relay information and sometimes a switch or access-point circuit identifier. Treat client-supplied names as hints because they can be absent, stale or deliberately misleading.

Match the lease timestamp and subnet to the ARP observation. If the client uses a randomised MAC address, an authenticated username or managed-device identifier is a stronger link than the vendor prefix.

Normalise and look up the addresses

Network tools commonly display colon-separated, dash-separated, dotted or plain hexadecimal values. The bulk lookup tool recognises these formats inside pasted text, removes duplicates from the lookup workload, applies longest-prefix matching and produces a CSV export.

1. Copy only the relevant command output and remove secrets or unrelated user data.
2. Paste up to 1,000 addresses or lines into the bulk tool.
3. Review locally administered results separately from registered prefixes.
4. Export the results and join them to your port, VLAN, IP and lease records.

Interpret vendor names carefully

The registry holder may be a parent company, component maker or historic organisation name. A phone, camera or appliance can use a network interface sourced from another manufacturer. Conversely, one familiar vendor can produce many unrelated products.

Use the vendor directory to inspect all assignments under an exact registry name. Differences in punctuation and corporate naming can create separate entries, so search for a distinctive part of the name.

A repeatable investigation record

For each observation, retain the MAC address, address type, vendor result, VLAN or SSID, switch and port, associated IP, DHCP identity, first and last observed times, and the source command. This makes later review possible and prevents a vendor name from becoming an unsupported device identification.

Automating the workflow

For scheduled inventory processing, call the REST API and cache results by the most specific prefix. Use bounded concurrency and exponential backoff for temporary 429 or 503 responses. The OpenAPI document and examples on the API page provide a starting point.