How can you check the Mac Address of an IP for MikroTik VPS by CLI and with Winbox 2023?

First, we will explain what Mac Address is and Everything about it.

If you’ve ever tried to identify devices on a network or search for a nearby Bluetooth device, chances are you’ve come across a MAC address. MAC Address and IP address identify devices on the network, but they do so at different levels. To know what the MAC address is? What it does and how it differs from the IP address stay with us in the rest of this article.

What is a Mac address?

It would help if you had both software and hardware within a wired or wireless network to transfer data from your device to another device that may be thousands of kilometers away; Correct sending and receiving of this data is related to addresses. Every device connected to the Internet has two types of addresses: physical address (MAC) and Internet address (IP). Physical address or mac address is an abbreviation of media access control which means media access control that introduces a device to other devices in the local network. IP addresses identify devices globally, but a packet within a network needs both of these addresses to reach its destination.

The MAC address is assigned to the devices by their manufacturer. It is also known by different names such as network hardware address, physical address, Ethernet hardware address (EHA) and BIA address. Bluetooth, Wi-Fi, and Ethernet connections all use MAC addresses. To identify which device is on your local network, the MAC address is used, which is always a 12-digit hexadecimal number separated by a period or a space. For example, a MAC address that is 2c549188c9e3 is displayed in both the following forms:

• 2C:54:91:88:C9:E3
• 2c-54-91-88-c9-e3

The first half of the number is usually used as the manufacturer ID, and the second half is the device ID. Each network card installed on a device has a unique MAC address, and no two devices on the same local network should have the same MAC address. If this happens, both devices will have communication problems; Because the local network gets confused about which device should receive the packet. When a switch broadcasts a packet to all ports to find the intended recipient, whichever device responds first receives the packet. If the device reboots, crashes, or shuts down in the meantime, the other device may receive the packet.

You may be wondering if a device can have more than one MAC address. Yes! For each network interface on your device, there is a unique MAC address associated with it. Most devices today connect to the Internet either physically with an Ethernet cable or wirelessly with Wi-Fi, so if your device has both an Ethernet port and built-in Wi-Fi, you will see two MAC addresses in the system configuration, one for the Ethernet port and One for Wi-Fi.

Differences between MAC address and IP address

The IP address is a numerical label that is assigned to every device connected to a computer network that uses the Internet Protocol to communicate, and according to this address, every router on the Internet knows which direction to send the data packet to; But the MAC address is a unique identifier that is assigned to the network interface controller of the computing device (NIC), and it is not possible to send and receive packets with the MAC address alone; Both of these addresses identify devices on the network in different ways. These two addresses have differences from each other, which we have discussed below.

Differences in the names of the addresses

As we said before, the MAC address is the abbreviation of the Media Access Control address, and the IP address is the abbreviation of the Internet Protocol address. MAC address is also called physical address, hardware address, or Ethernet address. On the other hand, an IP address is also called a logical address, network address or Internet address.

Inconsistency in the use of addresses

A MAC address helps to uniquely identify a device, while an IP address is an address that helps you identify a network connection. If we want to explain with an example, like the password that is unique for each person, the MAC address is also unique for each device; And the IP address can be considered like a postal code when a package is to be sent to someone, their home address is determined by the postal code and the national code determines their unique address. Note that the MAC address works at the data link layer while the IP address works at the network layer.

Differences in address allocation

The length of the MAC address is 48 bits, the IPv4 address is 32 bits, and the IPv6 address is 128 bits; The MAC address is assigned by the device manufacturers, while the IP address is assigned to the device by an Internet service provider or an ISP; Therefore, MAC address is a hardware-oriented address and IP address is a software-oriented one. MAC addresses are not flexible and remain fixed for a device, but IP addresses are flexible and change every time you connect to a different network.

MAC address is only important in the local network and helps you identify the device in local network, and it is not used anymore after the packets leave that network, but IP address helps you identify the device in the global network. . Mac address filter feature helps prevent security threats by hackers, but IP address has no special filter. You can’t hide MAC addresses from a device, but you can hide IP addresses using a router or VPN.

How does Mac address work?

Any internet software, such as a web browser, routes data across the internet using the destination IP address. Internet routers transfer packets from the source network to the destination network and then to the local network where the destination device is connected. That LAN translates the IP address to a MAC address, adds the MAC address to the data stream, and sends the data to the appropriate device.

What is the MAC address used for?

One of the uses of MAC addresses in the filtering process is in wireless networks. To prevent strangers from accessing the network, the router is set to accept only certain MAC addresses; That way, if the IP address is a dynamic address and changes, the MAC address can still identify the device. Filtering can be used to track network users and restrict their access. MAC address also has other uses; for example, when a stolen device is connected to the network, the geographical location of the devices in the network can be identified; For this reason, many companies and institutions require the MAC address of their members’ devices. Therefore, it is important for device owners not to disclose their MAC address to anyone except authorized personnel.

MAC addresses can also be used in data recovery to connect to a wireless device. Disk Drill is an application developed by Cleverfiles that helps in data recovery. By scanning in two modes, Quick and Deep Scan, it searches for lost files. A quick scan uses the cloud data still available on the file system. Deep Scan works deeper at the binary level and the results are presented with the help of a filter. Disk Drill is available for Windows and Mac computers, and you can download it for free. Also, DHCP servers use MAC addresses to identify devices and assign static IP addresses to certain devices.

How can you check the Mac Address of an IP for MikroTik VPS by CL and with Winbox?

How to get IP, MAC, and EtherPort for all currently active EtherPorts?
I.e., for ports of router/switch that have active/alive devices attached? We, of course, mean the IP and MAC of the attached device and the EtherPort of the router/switch.

The commands show the mac-address-table on a MikroTik Router. In addition to using the command line to show the mac address table, in this tutorial, I will also show you how to search for a specific MAC address and filter the table to show mac addresses learned through a specific port. You should know several commands, depending on how your router is configured.

The two types of configuration are software switching (using bridge interfaces) and hardware switching. You can have a valid configuration that uses both. And in this scenario, separate mac address tables are maintained.

{
:local ethlist {"ether1-WAN1";"ether2-WAN2";"ether3-LAN1";"ether4-LAN2"};
:local buffer;
:local fileName "address-list";

:foreach a in=$ethlist do={
	:if ([/interface ethernet print as-value where name=$a && running=yes]) do={
		:foreach i in=[/ip arp print as-value where interface=$a] do={
			:set $buffer ($buffer." address=".$i->"address"." - mac-address=".$i->"mac-address"." - ETH=".$a."\n");
		}
	}
}

/file print file=$fileName where name="";
delay 1s;
/file set $fileName contents=$buffer;
}

You need to set your values for variable enlist (this is an example), adding all of your ETH interfaces; the script will list only addresses from those running.

You can try this script, which lists all needed data in a file.