Find MAC address in the filesystemHow do I extract the source MAC from a [UFW BLOCK] entry?NetworkManager...
How to reduce LED flash rate (frequency)
Map of water taps to fill bottles
What route did the Hindenburg take when traveling from Germany to the U.S.?
Please, smoke with good manners
Can SQL Server create collisions in system generated constraint names?
Minor Revision with suggestion of an alternative proof by reviewer
Does a strong solution to a SDE imply lipschitz condition?
What are the potential pitfalls when using metals as a currency?
Is it idiomatic to construct against `this`?
Why does nature favour the Laplacian?
Why is it that the natural deduction method can't test for invalidity?
Why other Westeros houses don't use wildfire?
Phrase for the opposite of "foolproof"
Seemingly unused edef prior to an ifx mysteriously affects the outcome of the ifx. Why?
A Note on N!
Is the claim "Employers won't employ people with no 'social media presence'" realistic?
Combinable filters
Why do games have consumables?
Critique of timeline aesthetic
What does the "ep" capability mean?
Don’t seats that recline flat defeat the purpose of having seatbelts?
Does Gita support doctrine of eternal cycle of birth and death for evil people?
What language was spoken in East Asia before Proto-Turkic?
How can I practically buy stocks?
Find MAC address in the filesystem
How do I extract the source MAC from a [UFW BLOCK] entry?NetworkManager problem with 'cloned MAC address'How can I change the network configuration on Ubuntu 14.04 server?What is the difference between “Cloned MAC address” in “Edit Connection” GUI and ifconfig command?Is there any command line equivalent for “Edit Connection” GUI?MAC cloning does'nt work in a MAC filtered WiFi networkMAC address spoofing failingWhy is there no easy PERMANENT way to spoof your wifi Mac address on ubuntu?IP address exists with no internet connectionMAC address getting resetHow to change MAC address in ubuntu 16.04
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ margin-bottom:0;
}
My laptop is down, but I need to extract its MAC address thas was previously used to establish wifi connection. The filesystem was cloned, so I am trying to find any configurational file which contains the string with MAC address. What file is usually red by ifconfig to display network interfaces information?
networking configuration ifconfig
asked Oct 31 '15 at 14:09
freudefreude
13015
add a comment |
My laptop is down, but I need to extract its MAC address thas was previously used to establish wifi connection. The filesystem was cloned, so I am trying to find any configurational file which contains the string with MAC address. What file is usually red by ifconfig to display network interfaces information?
networking configuration ifconfig
asked Oct 31 '15 at 14:09
freudefreude
13015
add a comment |
My laptop is down, but I need to extract its MAC address thas was previously used to establish wifi connection. The filesystem was cloned, so I am trying to find any configurational file which contains the string with MAC address. What file is usually red by ifconfig to display network interfaces information?
networking configuration ifconfig
asked Oct 31 '15 at 14:09
freudefreude
13015
My laptop is down, but I need to extract its MAC address thas was previously used to establish wifi connection. The filesystem was cloned, so I am trying to find any configurational file which contains the string with MAC address. What file is usually red by ifconfig to display network interfaces information?
networking configuration ifconfig
networking configuration ifconfig
asked Oct 31 '15 at 14:09
freudefreude
13015
asked Oct 31 '15 at 14:09
freudefreude
13015
asked Oct 31 '15 at 14:09
freudefreude
13015
asked Oct 31 '15 at 14:09
freudefreude
13015
asked Oct 31 '15 at 14:09
freudefreude
13015
13015
add a comment |
add a comment |
3 Answers
3
active
oldest
votes
Option 1: /etc/udev/rules.d/70-persistent-net.rules
Option 2: /etc/NetworkManager/system-connections directory, inspect any of the files for connections listed there.
Options 3: /var/log/syslog file and archived ones, syslog.*.gz. Specifically, look for something in format date hostname dhclient: Listening on LPF/wlan0/XX:XX:XX:XX:XX:XX
Option 4: May be listed in dmesg log as well, however at least for me personally, it took form without : as separator. Here's what I mean
[ 5.655159] ieee80211 phy0: hwaddr b482fed38556, RTL8187SE + rtl8225-se
side note: since /sys filesystem exists only at runtime , as does /proc , it's impossible to view /sys/class/net/wlan0/address file, however I will leave that as side note, in case one needs a file usable at run-time.
answered Oct 31 '15 at 14:22
Sergiy KolodyazhnyySergiy Kolodyazhnyy
75.8k9158333
4
/sys/isn't real so may not exist in the clone. Option 2 only works if you specify which adapter a connection should connect on. Option 3 requires your last boot to have been fairly successful. Option 1 is the best bet.
– Oli♦
Oct 31 '15 at 14:44
The second option works for me. Strange, but I don't have file 70-persistent-net.rules in my filesystem
– freude
Oct 31 '15 at 14:47
Option #2 should work in 99% of the cases, because for the most part Ubuntu users use NetworkManager, unless the user is usingwicdor command-line only method. @freude do you have it listed with a different starting number perhaps ?
– Sergiy Kolodyazhnyy
Oct 31 '15 at 14:51
1
@Serg It's virtual; it never really exists. The files are coming from inside the house, etc. Same with things like/dev,/proc,/run.
– Oli♦
Oct 31 '15 at 15:02
4
/sysis virtual. It does not exist on disk. You should remove #4 from the list.
– Andrew Medico
Oct 31 '15 at 19:49
|
show 4 more comments
On Ubuntu server 18.04, I found the MAC address in /var/log/syslog and /var/log/ufw.log as :
Dec 7 02:49:08 hostname kernel: [1870435.881302] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.114.154 DST=XXX.YYY.138.47 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=54321 PROTO=TCP SPT=40963 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0
Dec 7 02:54:32 hostname kernel: [1870760.588719] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.25.65 DST=XXX.YYY.138.47 LEN=44 TOS=0x00 PREC=0x00 TTL=56 ID=36934 PROTO=TCP SPT=2740 DPT=80 WINDOW=35007 RES=0x00 SYN URGP=0
Dec 7 03:01:22 hostname kernel: [1871170.660324] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.106.221 DST=XXX.YYY.138.47 LEN=40 TOS=0x00 PREC=0x00 TTL=237 ID=1440 PROTO=TCP SPT=58914 DPT=80 WINDOW=1024 RES=0x00 SYN URGP=0
Using this answer to parse the log, the desired MAC address is:
xx:yy:2b:49:c7:23
answered Dec 10 '18 at 11:14
Eric DuminilEric Duminil
33317
add a comment |
You can get it from arp cache
cat /proc/net/arp
answered 16 hours ago
Arun PradeepArun Pradeep
111
New contributor
Arun Pradeep is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "89"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f692258%2ffind-mac-address-in-the-filesystem%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
3 Answers
3
active
oldest
votes
3 Answers
3
active
oldest
votes
active
oldest
votes
active
oldest
votes
Option 1: /etc/udev/rules.d/70-persistent-net.rules
Option 2: /etc/NetworkManager/system-connections directory, inspect any of the files for connections listed there.
Options 3: /var/log/syslog file and archived ones, syslog.*.gz. Specifically, look for something in format date hostname dhclient: Listening on LPF/wlan0/XX:XX:XX:XX:XX:XX
Option 4: May be listed in dmesg log as well, however at least for me personally, it took form without : as separator. Here's what I mean
[ 5.655159] ieee80211 phy0: hwaddr b482fed38556, RTL8187SE + rtl8225-se
side note: since /sys filesystem exists only at runtime , as does /proc , it's impossible to view /sys/class/net/wlan0/address file, however I will leave that as side note, in case one needs a file usable at run-time.
answered Oct 31 '15 at 14:22
Sergiy KolodyazhnyySergiy Kolodyazhnyy
75.8k9158333
4
/sys/isn't real so may not exist in the clone. Option 2 only works if you specify which adapter a connection should connect on. Option 3 requires your last boot to have been fairly successful. Option 1 is the best bet.
– Oli♦
Oct 31 '15 at 14:44
The second option works for me. Strange, but I don't have file 70-persistent-net.rules in my filesystem
– freude
Oct 31 '15 at 14:47
Option #2 should work in 99% of the cases, because for the most part Ubuntu users use NetworkManager, unless the user is usingwicdor command-line only method. @freude do you have it listed with a different starting number perhaps ?
– Sergiy Kolodyazhnyy
Oct 31 '15 at 14:51
1
@Serg It's virtual; it never really exists. The files are coming from inside the house, etc. Same with things like/dev,/proc,/run.
– Oli♦
Oct 31 '15 at 15:02
4
/sysis virtual. It does not exist on disk. You should remove #4 from the list.
– Andrew Medico
Oct 31 '15 at 19:49
|
show 4 more comments
Option 1: /etc/udev/rules.d/70-persistent-net.rules
Option 2: /etc/NetworkManager/system-connections directory, inspect any of the files for connections listed there.
Options 3: /var/log/syslog file and archived ones, syslog.*.gz. Specifically, look for something in format date hostname dhclient: Listening on LPF/wlan0/XX:XX:XX:XX:XX:XX
Option 4: May be listed in dmesg log as well, however at least for me personally, it took form without : as separator. Here's what I mean
[ 5.655159] ieee80211 phy0: hwaddr b482fed38556, RTL8187SE + rtl8225-se
side note: since /sys filesystem exists only at runtime , as does /proc , it's impossible to view /sys/class/net/wlan0/address file, however I will leave that as side note, in case one needs a file usable at run-time.
answered Oct 31 '15 at 14:22
Sergiy KolodyazhnyySergiy Kolodyazhnyy
75.8k9158333
4
/sys/isn't real so may not exist in the clone. Option 2 only works if you specify which adapter a connection should connect on. Option 3 requires your last boot to have been fairly successful. Option 1 is the best bet.
– Oli♦
Oct 31 '15 at 14:44
The second option works for me. Strange, but I don't have file 70-persistent-net.rules in my filesystem
– freude
Oct 31 '15 at 14:47
Option #2 should work in 99% of the cases, because for the most part Ubuntu users use NetworkManager, unless the user is usingwicdor command-line only method. @freude do you have it listed with a different starting number perhaps ?
– Sergiy Kolodyazhnyy
Oct 31 '15 at 14:51
1
@Serg It's virtual; it never really exists. The files are coming from inside the house, etc. Same with things like/dev,/proc,/run.
– Oli♦
Oct 31 '15 at 15:02
4
/sysis virtual. It does not exist on disk. You should remove #4 from the list.
– Andrew Medico
Oct 31 '15 at 19:49
|
show 4 more comments
Option 1: /etc/udev/rules.d/70-persistent-net.rules
Option 2: /etc/NetworkManager/system-connections directory, inspect any of the files for connections listed there.
Options 3: /var/log/syslog file and archived ones, syslog.*.gz. Specifically, look for something in format date hostname dhclient: Listening on LPF/wlan0/XX:XX:XX:XX:XX:XX
Option 4: May be listed in dmesg log as well, however at least for me personally, it took form without : as separator. Here's what I mean
[ 5.655159] ieee80211 phy0: hwaddr b482fed38556, RTL8187SE + rtl8225-se
side note: since /sys filesystem exists only at runtime , as does /proc , it's impossible to view /sys/class/net/wlan0/address file, however I will leave that as side note, in case one needs a file usable at run-time.
answered Oct 31 '15 at 14:22
Sergiy KolodyazhnyySergiy Kolodyazhnyy
75.8k9158333
Option 1: /etc/udev/rules.d/70-persistent-net.rules
Option 2: /etc/NetworkManager/system-connections directory, inspect any of the files for connections listed there.
Options 3: /var/log/syslog file and archived ones, syslog.*.gz. Specifically, look for something in format date hostname dhclient: Listening on LPF/wlan0/XX:XX:XX:XX:XX:XX
Option 4: May be listed in dmesg log as well, however at least for me personally, it took form without : as separator. Here's what I mean
[ 5.655159] ieee80211 phy0: hwaddr b482fed38556, RTL8187SE + rtl8225-se
side note: since /sys filesystem exists only at runtime , as does /proc , it's impossible to view /sys/class/net/wlan0/address file, however I will leave that as side note, in case one needs a file usable at run-time.
answered Oct 31 '15 at 14:22
Sergiy KolodyazhnyySergiy Kolodyazhnyy
75.8k9158333
edited Nov 2 '15 at 10:11
answered Oct 31 '15 at 14:22
Sergiy KolodyazhnyySergiy Kolodyazhnyy
75.8k9158333
answered Oct 31 '15 at 14:22
Sergiy KolodyazhnyySergiy Kolodyazhnyy
75.8k9158333
answered Oct 31 '15 at 14:22
Sergiy KolodyazhnyySergiy Kolodyazhnyy
75.8k9158333
75.8k9158333
4
/sys/isn't real so may not exist in the clone. Option 2 only works if you specify which adapter a connection should connect on. Option 3 requires your last boot to have been fairly successful. Option 1 is the best bet.
– Oli♦
Oct 31 '15 at 14:44
The second option works for me. Strange, but I don't have file 70-persistent-net.rules in my filesystem
– freude
Oct 31 '15 at 14:47
Option #2 should work in 99% of the cases, because for the most part Ubuntu users use NetworkManager, unless the user is usingwicdor command-line only method. @freude do you have it listed with a different starting number perhaps ?
– Sergiy Kolodyazhnyy
Oct 31 '15 at 14:51
1
@Serg It's virtual; it never really exists. The files are coming from inside the house, etc. Same with things like/dev,/proc,/run.
– Oli♦
Oct 31 '15 at 15:02
4
/sysis virtual. It does not exist on disk. You should remove #4 from the list.
– Andrew Medico
Oct 31 '15 at 19:49
|
show 4 more comments
4
/sys/isn't real so may not exist in the clone. Option 2 only works if you specify which adapter a connection should connect on. Option 3 requires your last boot to have been fairly successful. Option 1 is the best bet.
– Oli♦
Oct 31 '15 at 14:44
The second option works for me. Strange, but I don't have file 70-persistent-net.rules in my filesystem
– freude
Oct 31 '15 at 14:47
Option #2 should work in 99% of the cases, because for the most part Ubuntu users use NetworkManager, unless the user is usingwicdor command-line only method. @freude do you have it listed with a different starting number perhaps ?
– Sergiy Kolodyazhnyy
Oct 31 '15 at 14:51
1
@Serg It's virtual; it never really exists. The files are coming from inside the house, etc. Same with things like/dev,/proc,/run.
– Oli♦
Oct 31 '15 at 15:02
4
/sysis virtual. It does not exist on disk. You should remove #4 from the list.
– Andrew Medico
Oct 31 '15 at 19:49
4
4
/sys/ isn't real so may not exist in the clone. Option 2 only works if you specify which adapter a connection should connect on. Option 3 requires your last boot to have been fairly successful. Option 1 is the best bet.– Oli♦
Oct 31 '15 at 14:44
/sys/ isn't real so may not exist in the clone. Option 2 only works if you specify which adapter a connection should connect on. Option 3 requires your last boot to have been fairly successful. Option 1 is the best bet.– Oli♦
Oct 31 '15 at 14:44
The second option works for me. Strange, but I don't have file 70-persistent-net.rules in my filesystem
– freude
Oct 31 '15 at 14:47
The second option works for me. Strange, but I don't have file 70-persistent-net.rules in my filesystem
– freude
Oct 31 '15 at 14:47
Option #2 should work in 99% of the cases, because for the most part Ubuntu users use NetworkManager, unless the user is using
wicd or command-line only method. @freude do you have it listed with a different starting number perhaps ?– Sergiy Kolodyazhnyy
Oct 31 '15 at 14:51
Option #2 should work in 99% of the cases, because for the most part Ubuntu users use NetworkManager, unless the user is using
wicd or command-line only method. @freude do you have it listed with a different starting number perhaps ?– Sergiy Kolodyazhnyy
Oct 31 '15 at 14:51
1
1
@Serg It's virtual; it never really exists. The files are coming from inside the house, etc. Same with things like
/dev, /proc, /run.– Oli♦
Oct 31 '15 at 15:02
@Serg It's virtual; it never really exists. The files are coming from inside the house, etc. Same with things like
/dev, /proc, /run.– Oli♦
Oct 31 '15 at 15:02
4
4
/sys is virtual. It does not exist on disk. You should remove #4 from the list.– Andrew Medico
Oct 31 '15 at 19:49
/sys is virtual. It does not exist on disk. You should remove #4 from the list.– Andrew Medico
Oct 31 '15 at 19:49
|
show 4 more comments
On Ubuntu server 18.04, I found the MAC address in /var/log/syslog and /var/log/ufw.log as :
Dec 7 02:49:08 hostname kernel: [1870435.881302] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.114.154 DST=XXX.YYY.138.47 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=54321 PROTO=TCP SPT=40963 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0
Dec 7 02:54:32 hostname kernel: [1870760.588719] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.25.65 DST=XXX.YYY.138.47 LEN=44 TOS=0x00 PREC=0x00 TTL=56 ID=36934 PROTO=TCP SPT=2740 DPT=80 WINDOW=35007 RES=0x00 SYN URGP=0
Dec 7 03:01:22 hostname kernel: [1871170.660324] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.106.221 DST=XXX.YYY.138.47 LEN=40 TOS=0x00 PREC=0x00 TTL=237 ID=1440 PROTO=TCP SPT=58914 DPT=80 WINDOW=1024 RES=0x00 SYN URGP=0
Using this answer to parse the log, the desired MAC address is:
xx:yy:2b:49:c7:23
answered Dec 10 '18 at 11:14
Eric DuminilEric Duminil
33317
add a comment |
On Ubuntu server 18.04, I found the MAC address in /var/log/syslog and /var/log/ufw.log as :
Dec 7 02:49:08 hostname kernel: [1870435.881302] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.114.154 DST=XXX.YYY.138.47 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=54321 PROTO=TCP SPT=40963 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0
Dec 7 02:54:32 hostname kernel: [1870760.588719] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.25.65 DST=XXX.YYY.138.47 LEN=44 TOS=0x00 PREC=0x00 TTL=56 ID=36934 PROTO=TCP SPT=2740 DPT=80 WINDOW=35007 RES=0x00 SYN URGP=0
Dec 7 03:01:22 hostname kernel: [1871170.660324] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.106.221 DST=XXX.YYY.138.47 LEN=40 TOS=0x00 PREC=0x00 TTL=237 ID=1440 PROTO=TCP SPT=58914 DPT=80 WINDOW=1024 RES=0x00 SYN URGP=0
Using this answer to parse the log, the desired MAC address is:
xx:yy:2b:49:c7:23
answered Dec 10 '18 at 11:14
Eric DuminilEric Duminil
33317
add a comment |
On Ubuntu server 18.04, I found the MAC address in /var/log/syslog and /var/log/ufw.log as :
Dec 7 02:49:08 hostname kernel: [1870435.881302] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.114.154 DST=XXX.YYY.138.47 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=54321 PROTO=TCP SPT=40963 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0
Dec 7 02:54:32 hostname kernel: [1870760.588719] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.25.65 DST=XXX.YYY.138.47 LEN=44 TOS=0x00 PREC=0x00 TTL=56 ID=36934 PROTO=TCP SPT=2740 DPT=80 WINDOW=35007 RES=0x00 SYN URGP=0
Dec 7 03:01:22 hostname kernel: [1871170.660324] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.106.221 DST=XXX.YYY.138.47 LEN=40 TOS=0x00 PREC=0x00 TTL=237 ID=1440 PROTO=TCP SPT=58914 DPT=80 WINDOW=1024 RES=0x00 SYN URGP=0
Using this answer to parse the log, the desired MAC address is:
xx:yy:2b:49:c7:23
answered Dec 10 '18 at 11:14
Eric DuminilEric Duminil
33317
On Ubuntu server 18.04, I found the MAC address in /var/log/syslog and /var/log/ufw.log as :
Dec 7 02:49:08 hostname kernel: [1870435.881302] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.114.154 DST=XXX.YYY.138.47 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=54321 PROTO=TCP SPT=40963 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0
Dec 7 02:54:32 hostname kernel: [1870760.588719] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.25.65 DST=XXX.YYY.138.47 LEN=44 TOS=0x00 PREC=0x00 TTL=56 ID=36934 PROTO=TCP SPT=2740 DPT=80 WINDOW=35007 RES=0x00 SYN URGP=0
Dec 7 03:01:22 hostname kernel: [1871170.660324] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.106.221 DST=XXX.YYY.138.47 LEN=40 TOS=0x00 PREC=0x00 TTL=237 ID=1440 PROTO=TCP SPT=58914 DPT=80 WINDOW=1024 RES=0x00 SYN URGP=0
Using this answer to parse the log, the desired MAC address is:
xx:yy:2b:49:c7:23
answered Dec 10 '18 at 11:14
Eric DuminilEric Duminil
33317
answered Dec 10 '18 at 11:14
Eric DuminilEric Duminil
33317
answered Dec 10 '18 at 11:14
Eric DuminilEric Duminil
33317
answered Dec 10 '18 at 11:14
Eric DuminilEric Duminil
33317
33317
add a comment |
add a comment |
You can get it from arp cache
cat /proc/net/arp
answered 16 hours ago
Arun PradeepArun Pradeep
111
New contributor
Arun Pradeep is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
You can get it from arp cache
cat /proc/net/arp
answered 16 hours ago
Arun PradeepArun Pradeep
111
New contributor
Arun Pradeep is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
You can get it from arp cache
cat /proc/net/arp
answered 16 hours ago
Arun PradeepArun Pradeep
111
New contributor
Arun Pradeep is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
You can get it from arp cache
cat /proc/net/arp
answered 16 hours ago
Arun PradeepArun Pradeep
111
New contributor
Arun Pradeep is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
answered 16 hours ago
Arun PradeepArun Pradeep
111
New contributor
Arun Pradeep is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
answered 16 hours ago
Arun PradeepArun Pradeep
111
answered 16 hours ago
Arun PradeepArun Pradeep
111
111
New contributor
Arun Pradeep is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
New contributor
Arun Pradeep is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
Arun Pradeep is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
add a comment |
add a comment |
Thanks for contributing an answer to Ask Ubuntu!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f692258%2ffind-mac-address-in-the-filesystem%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
