Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A computer I only have remote access to is shutdown, but it has been powered on in the last 2 hours..

I have access to another PC on the same LAN, will the target computer's MAC address persist somewhere so I can read it from so that I can send it a WOL packet?

If so, where will it be? And how can I read it?

share|improve this question
up vote 4 down vote accepted

It would be stored in ARP tables on devices in the same network as it (any device, computers, routers, etc.), or in the MAC address table of the switch it's directly connected to.

ARP caches on PCs tend to expire very quickly (less than a minute in Windows Vista/7), so you're not going to find anything there; the same is true for MAC address tables on switches (default timeout is 5 minutes for Cisco), and you would anyway need a managed switch (and access to it) in order to inspect its MAC table.

The only place you'll likely find a MAC address after 2 hours is in the logs or configuration for your DHCP server -- and that's assuming that the host is configured using DHCP. Otherwise, I'm sorry, but I don't think you will be able to find anything after 2 hours.

share|improve this answer
To add to this, if you have access to the DHCP server, you should be able to get the MAC from that. – Nixphoe Jul 19 '11 at 16:26
That's true only if the computer obtained its IP address using DHCP in the first place. – Massimo Jul 19 '11 at 16:27
Small detail over looked, but VERY important! – Nixphoe Jul 19 '11 at 16:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.