PowerShell Find IP from MAC Address

by

Do you want to find an IP address from a MAC address using PowerShell? I will explain in detail how to find it with examples. You will learn how to map MAC addresses to IP addresses on your local network using PowerShell.

What Are MAC and IP Addresses

Let me explain first the difference between MAC and IP addresses.

  • MAC Address: A unique hardware identifier assigned to a network adapter. It’s a 48-bit hexadecimal number, e.g., 00-1A-2B-3C-4D-5E.
  • IP Address: An address assigned to a device on a network to identify it logically, e.g., 192.168.1.10.

While IP addresses can change dynamically (especially with DHCP), MAC addresses are static and tied to the device’s network interface.

Note: You need administrative privileges on your Windows machine.

Check out Get MacBook Pro Battery Health Using PowerShell

Method 1: Using ARP Cache with PowerShell

The Address Resolution Protocol (ARP) cache stores IP-to-MAC mappings your computer has recently communicated with.

Step 1: Display the ARP Table

Open PowerShell and run:

arp -a

This lists IP addresses and their corresponding MAC addresses.

Step 2: Filter ARP Output for a Specific MAC

To find the IP for a specific MAC, use:

$mac = "01-00-xx-00-00-fb"
arp -a | ForEach-Object {
    if ($_ -match $mac) { $_ }
}
  • arp -a outputs the ARP table.
  • ForEach-Object scans each line for the MAC address.
  • Matching lines show the IP and MAC.

Here is the exact output in the screenshot below:

PowerShell Find IP from MAC Address

Below are some limitations of this method.

  • The device must be in your ARP cache (recently communicated).
  • Only local subnet devices appear.
  • ARP cache may be incomplete or outdated.

Read Get Your MacBook Pro Model Number Using PowerShell

Method 2: Using Get-NetNeighbor Cmdlet

PowerShell’s Get-NetNeighbor cmdlet is designed to manage neighbor cache entries (similar to ARP cache).

Step 1: List All Neighbor Entries

Get-NetNeighbor -AddressFamily IPv4 | Format-Table -AutoSize

This shows IP addresses, MAC addresses, and states.

Step 2: Filter by MAC Address

$mac = "01-00-5E-7F-FF-FA"
Get-NetNeighbor -AddressFamily IPv4 | Where-Object { $_.LinkLayerAddress -eq $mac }

This returns the IP address associated with the MAC.

Here is the exact output in the screenshot below:

Find IP from MAC Address PowerShell

This method has some advantages, such as:

  • Native PowerShell cmdlet, no external commands.
  • Provides state info (Reachable, Stale, etc.).
  • Supports IPv4 and IPv6.

Check out PowerShell Get MacBook Pro Serial Number

Method 3: Querying DHCP Server for IP-MAC Mapping

If you have access to your DHCP server, you can query its lease database to find IP-MAC mappings.

Using PowerShell with DHCP Server Module

Import-Module DHCPServer

$mac = "00-1A-2B-3C-4D-5E"
Get-DhcpServerv4Lease -ComputerName "dhcpserver.domain.local" | Where-Object { $_.ClientId -eq $mac }

Notes:

  • Requires DHCP Server role or remote access.
  • Provides accurate IPs assigned by DHCP.
  • Useful in enterprise environments.

Read Get the Current Username in PowerShell on MacBook Pro

Complete PowerShell Script

Here’s a reusable PowerShell script combining ARP and Get-NetNeighbor methods:

param (
    [Parameter(Mandatory=$true)]
    [string]$MacAddress
)

function Normalize-Mac($mac) {
    return $mac.ToUpper().Replace(":", "-")
}

$mac = Normalize-Mac $MacAddress

# Try Get-NetNeighbor first
$neighbor = Get-NetNeighbor -AddressFamily IPv4 | Where-Object { $_.LinkLayerAddress -eq $mac }

if ($neighbor) {
    Write-Output "IP Address for MAC $mac found using Get-NetNeighbor:"
    $neighbor | Format-Table IPAddress, LinkLayerAddress, State -AutoSize
} else {
    Write-Output "MAC $mac not found in Get-NetNeighbor cache. Checking ARP table..."
    $arpEntries = arp -a
    $found = $false
    foreach ($line in $arpEntries) {
        if ($line.ToUpper().Contains($mac)) {
            Write-Output $line
            $found = $true
        }
    }
    if (-not $found) {
        Write-Output "MAC address $mac not found in ARP cache."
    }
}

How to Use:

  1. Save as Find-IPFromMAC.ps1
  2. Run in PowerShell with:

Check out Enable BitLocker with PowerShell

Troubleshooting Tips

Now, let me suggest some troubleshooting tips that might help you while working with this.

  • Refresh ARP Cache: If the MAC address isn’t found in the ARP cache, try pinging the broadcast address or the subnet to populate the ARP table with active devices:
ping 192.168.1.255 -n 1

Replace 192.168.1.255 with your network’s broadcast address. Then rerun the ARP or Get-NetNeighbor commands.

  • Check Network Connectivity: Ensure your machine is on the same subnet or network segment as the target device. MAC-to-IP resolution generally only works within the local broadcast domain.
  • Use Elevated PowerShell: Run PowerShell as Administrator to avoid permission issues when accessing network information.
  • IPv6 Considerations: If your network uses IPv6, you can change the -AddressFamily parameter to IPv6 in Get-NetNeighbor to find IPv6 addresses by MAC.

Conclusion

In this tutorial, I explained how to find an IP address from a MAC address using PowerShell using different methods.

  • Use arp -a or Get-NetNeighbor cmdlet for quick local subnet lookups.
  • For enterprise environments, leverage DHCP server queries for accurate IP assignments.
  • Automate the process with PowerShell scripts to save time and improve accuracy.
  • Always ensure you have proper permissions and network access to perform these queries.

You may also like the following tutorials:

100 PowerShell cmdlets download free

100 POWERSHELL CMDLETS E-BOOK

FREE Download an eBook that contains 100 PowerShell cmdlets with complete script and examples.