Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My network segment is 192.168.0.*, the target network segment is 192.168.1.*, and I can ping it.

I want to get the target's (e.g.,'s) MAC address in my program (C# or VC).

I know I can use nmap to scan the network in Linux, but how would I go about doing it in Windows? The subnet mask is

Edit: Maybe nmap can not get mac address for different subnets too.

share|improve this question
There is nmap for windows, you can download from namp site. Just look for the windows version, it even come with a GUI. – John Siu Dec 28 '12 at 2:52
What is your outer problem? What do you plan to do with the MAC address? (There are solutions that will or will not work depending on what you're actually trying to do.) – David Schwartz Dec 28 '12 at 3:20
@DavidSchwartz I want to find one kind of device connected with the network. those devices own the same prefix MAC address for they are made in the same company. – peter Dec 28 '12 at 3:32
@peter: Ahh, okay. Then you need to ask some device connected to that network, such as the router. – David Schwartz Dec 28 '12 at 3:43
up vote 2 down vote accepted

Telling us the network address without telling us the subnet mask is like telling us your house number is 12345 but not telling us the street name. I'll just assume that the subnet mask is

You can't directly get the MAC address of the target machine if it resides in a different network for the following reasons:

A. The local machine will not ARP for the remote machine.

B. The local router will not ARP for the remote machine.

C. The remote router will ARP for the remote machine. The remote machine will respond to the ARP query and will send the rewspones to the querier, which is the remote router, where the response will stop.

If you need to find the MAC address of the remote machine you'll need access to the ARP cache on the remote router.

share|improve this answer
I am sorry forgeting to tell you network mask. You are right, the subnet mask indeed is you said that it cannot get MAC address of the target machine if it resides in a different network , but why nmap can do this? – peter Dec 28 '12 at 3:07
I don't see how it's possible for nmap to do that, but I've never used nmap. The local machine won't ARP for the remote machine so the remote MAC address won't be in the local ARP cache. Is it possible that nmap is finding the MAC address of the local router? – joeqwerty Dec 28 '12 at 3:11
Thanks @joeqwerty , maybe its hard to get mac address. – peter Dec 28 '12 at 4:27
It's not neccessarily hard. You just need access to a device on the remote network that can issue an ARP query for the remote machine whose MAC address you want to find. Then you need to view the ARP cache of that remote querier. The remote querier can be the router, a switch or a machine on the remote network. – joeqwerty Dec 28 '12 at 4:37
actually what i need: I want to find one kind of devices connected with the network. those devices own the same prefix MAC address for they are made in the same company, then i could get their IP address, and then access them with ip address. – peter Dec 28 '12 at 5:17

There is nmap for windows, you can download from namp site. Just look for the windows version, it even come with a GUI.

For C#, you can use SendARP().

share|improve this answer
Yes, nmap can work. But I donot want to install it and want to get MAC address in my program. thanks. – peter Dec 28 '12 at 3:13
Updated for C#. – John Siu Dec 28 '12 at 3:22
Thanks, for the same subnet network , i will try SendARP(). – peter Dec 28 '12 at 4:28
Are devices/machines of both subnets connected to the same switch, no router in between? – John Siu Dec 28 '12 at 4:37
I donot know, my PC is on wlan, and devices are on ethernet. They are in differet subnet. and arp -s cannot work for different subnet. – peter Dec 28 '12 at 6:28

For the same subnet:

arp will display your machine's arp table, which will include the MAC address of clients it's communicated with. So, ping, then arp to make sure you get a MAC address from the desired client.

(Use arp /? for the help/usage display on the command)

For a different subnet:

getmac /s [ip]

(Uses RPC, so better be Windows and need permissions on the target computer, so really only useful in an enterprise environment.)

EDIT : (Come to think of it, you might try the nbtstat command as well, given Windows. May or may not work, depending on the networking settings and configs, but it certainly can pull MAC addresses from different subnets.)

share|improve this answer
i tried, arp can not get different network segment IPs. – peter Dec 28 '12 at 3:02
@peter Yeah, sorry about that, that's because of what joeqwerty said. I didn't read carefully enough (hazard of working and ServerFaulting at the same time), so I added the getmac bit. As far as native options go, that's all I'm aware of, so if that's insufficient, it might be time to grab nmap for Windows. – HopelessN00b Dec 28 '12 at 3:08
Thanks. getmac can not work well since RPC problems. and nbtstat can not work too, and it says "Host not found ". – peter Dec 28 '12 at 3:41

Assuming you know that the target is a Windows system, I would use WMI (the Windows CIM implementation) to accomplish this. Here is the same question answered for VB.Net, which is easy enough to translate to VC or C#. As the link says, be sure to import the System.Management and System.Management.Instrumentation namespaces.

Dim theManagementScope as new ManagementScope("\\" & ComputerName & "\root\cimv2")
Dim theQueryString as new string = "SELECT * FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled = 1"

Dim theObjectQuery as new ObjectQuery(theQueryString)

Dim theSearcher as new ManagementObjectSearcher(theManagementScope, theObjectQuery)
Dim theResultsCollection as ManagementObjectCollection = theSearcher.Get()

for each currentResult as ManagementObject in theResultsCollection

It may also be possible to get the information from the DHCP server with DhcpEnumSubnetClients, DhcpEnumSubnetClientsV4 or DhcpEnumSubnetClientsV5. Not sure what kind of permissions you need to run that or if it has to be run from the DHCP server, though. Docs aren't very clear.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.