Find MAC address in the filesystem
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty{ margin-bottom:0;
}
My laptop is down, but I need to extract its MAC address thas was previously used to establish wifi connection. The filesystem was cloned, so I am trying to find any configurational file which contains the string with MAC address. What file is usually red by ifconfig to display network interfaces information?
networking configuration ifconfig
add a comment |
My laptop is down, but I need to extract its MAC address thas was previously used to establish wifi connection. The filesystem was cloned, so I am trying to find any configurational file which contains the string with MAC address. What file is usually red by ifconfig to display network interfaces information?
networking configuration ifconfig
add a comment |
My laptop is down, but I need to extract its MAC address thas was previously used to establish wifi connection. The filesystem was cloned, so I am trying to find any configurational file which contains the string with MAC address. What file is usually red by ifconfig to display network interfaces information?
networking configuration ifconfig
My laptop is down, but I need to extract its MAC address thas was previously used to establish wifi connection. The filesystem was cloned, so I am trying to find any configurational file which contains the string with MAC address. What file is usually red by ifconfig to display network interfaces information?
networking configuration ifconfig
networking configuration ifconfig
asked Oct 31 '15 at 14:09
freudefreude
13015
13015
add a comment |
add a comment |
3 Answers
3
active
oldest
votes
Option 1: /etc/udev/rules.d/70-persistent-net.rules
Option 2: /etc/NetworkManager/system-connections
directory, inspect any of the files for connections listed there.
Options 3: /var/log/syslog
file and archived ones, syslog.*.gz
. Specifically, look for something in format date hostname dhclient: Listening on LPF/wlan0/XX:XX:XX:XX:XX:XX
Option 4: May be listed in dmesg
log as well, however at least for me personally, it took form without :
as separator. Here's what I mean
[ 5.655159] ieee80211 phy0: hwaddr b482fed38556, RTL8187SE + rtl8225-se
side note: since /sys
filesystem exists only at runtime , as does /proc
, it's impossible to view /sys/class/net/wlan0/address
file, however I will leave that as side note, in case one needs a file usable at run-time.
4
/sys/
isn't real so may not exist in the clone. Option 2 only works if you specify which adapter a connection should connect on. Option 3 requires your last boot to have been fairly successful. Option 1 is the best bet.
– Oli♦
Oct 31 '15 at 14:44
The second option works for me. Strange, but I don't have file 70-persistent-net.rules in my filesystem
– freude
Oct 31 '15 at 14:47
Option #2 should work in 99% of the cases, because for the most part Ubuntu users use NetworkManager, unless the user is usingwicd
or command-line only method. @freude do you have it listed with a different starting number perhaps ?
– Sergiy Kolodyazhnyy
Oct 31 '15 at 14:51
1
@Serg It's virtual; it never really exists. The files are coming from inside the house, etc. Same with things like/dev
,/proc
,/run
.
– Oli♦
Oct 31 '15 at 15:02
4
/sys
is virtual. It does not exist on disk. You should remove #4 from the list.
– Andrew Medico
Oct 31 '15 at 19:49
|
show 4 more comments
On Ubuntu server 18.04, I found the MAC address in /var/log/syslog
and /var/log/ufw.log
as :
Dec 7 02:49:08 hostname kernel: [1870435.881302] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.114.154 DST=XXX.YYY.138.47 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=54321 PROTO=TCP SPT=40963 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0
Dec 7 02:54:32 hostname kernel: [1870760.588719] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.25.65 DST=XXX.YYY.138.47 LEN=44 TOS=0x00 PREC=0x00 TTL=56 ID=36934 PROTO=TCP SPT=2740 DPT=80 WINDOW=35007 RES=0x00 SYN URGP=0
Dec 7 03:01:22 hostname kernel: [1871170.660324] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.106.221 DST=XXX.YYY.138.47 LEN=40 TOS=0x00 PREC=0x00 TTL=237 ID=1440 PROTO=TCP SPT=58914 DPT=80 WINDOW=1024 RES=0x00 SYN URGP=0
Using this answer to parse the log, the desired MAC address is:
xx:yy:2b:49:c7:23
add a comment |
You can get it from arp cache
cat /proc/net/arp
New contributor
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "89"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f692258%2ffind-mac-address-in-the-filesystem%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
3 Answers
3
active
oldest
votes
3 Answers
3
active
oldest
votes
active
oldest
votes
active
oldest
votes
Option 1: /etc/udev/rules.d/70-persistent-net.rules
Option 2: /etc/NetworkManager/system-connections
directory, inspect any of the files for connections listed there.
Options 3: /var/log/syslog
file and archived ones, syslog.*.gz
. Specifically, look for something in format date hostname dhclient: Listening on LPF/wlan0/XX:XX:XX:XX:XX:XX
Option 4: May be listed in dmesg
log as well, however at least for me personally, it took form without :
as separator. Here's what I mean
[ 5.655159] ieee80211 phy0: hwaddr b482fed38556, RTL8187SE + rtl8225-se
side note: since /sys
filesystem exists only at runtime , as does /proc
, it's impossible to view /sys/class/net/wlan0/address
file, however I will leave that as side note, in case one needs a file usable at run-time.
4
/sys/
isn't real so may not exist in the clone. Option 2 only works if you specify which adapter a connection should connect on. Option 3 requires your last boot to have been fairly successful. Option 1 is the best bet.
– Oli♦
Oct 31 '15 at 14:44
The second option works for me. Strange, but I don't have file 70-persistent-net.rules in my filesystem
– freude
Oct 31 '15 at 14:47
Option #2 should work in 99% of the cases, because for the most part Ubuntu users use NetworkManager, unless the user is usingwicd
or command-line only method. @freude do you have it listed with a different starting number perhaps ?
– Sergiy Kolodyazhnyy
Oct 31 '15 at 14:51
1
@Serg It's virtual; it never really exists. The files are coming from inside the house, etc. Same with things like/dev
,/proc
,/run
.
– Oli♦
Oct 31 '15 at 15:02
4
/sys
is virtual. It does not exist on disk. You should remove #4 from the list.
– Andrew Medico
Oct 31 '15 at 19:49
|
show 4 more comments
Option 1: /etc/udev/rules.d/70-persistent-net.rules
Option 2: /etc/NetworkManager/system-connections
directory, inspect any of the files for connections listed there.
Options 3: /var/log/syslog
file and archived ones, syslog.*.gz
. Specifically, look for something in format date hostname dhclient: Listening on LPF/wlan0/XX:XX:XX:XX:XX:XX
Option 4: May be listed in dmesg
log as well, however at least for me personally, it took form without :
as separator. Here's what I mean
[ 5.655159] ieee80211 phy0: hwaddr b482fed38556, RTL8187SE + rtl8225-se
side note: since /sys
filesystem exists only at runtime , as does /proc
, it's impossible to view /sys/class/net/wlan0/address
file, however I will leave that as side note, in case one needs a file usable at run-time.
4
/sys/
isn't real so may not exist in the clone. Option 2 only works if you specify which adapter a connection should connect on. Option 3 requires your last boot to have been fairly successful. Option 1 is the best bet.
– Oli♦
Oct 31 '15 at 14:44
The second option works for me. Strange, but I don't have file 70-persistent-net.rules in my filesystem
– freude
Oct 31 '15 at 14:47
Option #2 should work in 99% of the cases, because for the most part Ubuntu users use NetworkManager, unless the user is usingwicd
or command-line only method. @freude do you have it listed with a different starting number perhaps ?
– Sergiy Kolodyazhnyy
Oct 31 '15 at 14:51
1
@Serg It's virtual; it never really exists. The files are coming from inside the house, etc. Same with things like/dev
,/proc
,/run
.
– Oli♦
Oct 31 '15 at 15:02
4
/sys
is virtual. It does not exist on disk. You should remove #4 from the list.
– Andrew Medico
Oct 31 '15 at 19:49
|
show 4 more comments
Option 1: /etc/udev/rules.d/70-persistent-net.rules
Option 2: /etc/NetworkManager/system-connections
directory, inspect any of the files for connections listed there.
Options 3: /var/log/syslog
file and archived ones, syslog.*.gz
. Specifically, look for something in format date hostname dhclient: Listening on LPF/wlan0/XX:XX:XX:XX:XX:XX
Option 4: May be listed in dmesg
log as well, however at least for me personally, it took form without :
as separator. Here's what I mean
[ 5.655159] ieee80211 phy0: hwaddr b482fed38556, RTL8187SE + rtl8225-se
side note: since /sys
filesystem exists only at runtime , as does /proc
, it's impossible to view /sys/class/net/wlan0/address
file, however I will leave that as side note, in case one needs a file usable at run-time.
Option 1: /etc/udev/rules.d/70-persistent-net.rules
Option 2: /etc/NetworkManager/system-connections
directory, inspect any of the files for connections listed there.
Options 3: /var/log/syslog
file and archived ones, syslog.*.gz
. Specifically, look for something in format date hostname dhclient: Listening on LPF/wlan0/XX:XX:XX:XX:XX:XX
Option 4: May be listed in dmesg
log as well, however at least for me personally, it took form without :
as separator. Here's what I mean
[ 5.655159] ieee80211 phy0: hwaddr b482fed38556, RTL8187SE + rtl8225-se
side note: since /sys
filesystem exists only at runtime , as does /proc
, it's impossible to view /sys/class/net/wlan0/address
file, however I will leave that as side note, in case one needs a file usable at run-time.
edited Nov 2 '15 at 10:11
answered Oct 31 '15 at 14:22
Sergiy KolodyazhnyySergiy Kolodyazhnyy
75.8k9158333
75.8k9158333
4
/sys/
isn't real so may not exist in the clone. Option 2 only works if you specify which adapter a connection should connect on. Option 3 requires your last boot to have been fairly successful. Option 1 is the best bet.
– Oli♦
Oct 31 '15 at 14:44
The second option works for me. Strange, but I don't have file 70-persistent-net.rules in my filesystem
– freude
Oct 31 '15 at 14:47
Option #2 should work in 99% of the cases, because for the most part Ubuntu users use NetworkManager, unless the user is usingwicd
or command-line only method. @freude do you have it listed with a different starting number perhaps ?
– Sergiy Kolodyazhnyy
Oct 31 '15 at 14:51
1
@Serg It's virtual; it never really exists. The files are coming from inside the house, etc. Same with things like/dev
,/proc
,/run
.
– Oli♦
Oct 31 '15 at 15:02
4
/sys
is virtual. It does not exist on disk. You should remove #4 from the list.
– Andrew Medico
Oct 31 '15 at 19:49
|
show 4 more comments
4
/sys/
isn't real so may not exist in the clone. Option 2 only works if you specify which adapter a connection should connect on. Option 3 requires your last boot to have been fairly successful. Option 1 is the best bet.
– Oli♦
Oct 31 '15 at 14:44
The second option works for me. Strange, but I don't have file 70-persistent-net.rules in my filesystem
– freude
Oct 31 '15 at 14:47
Option #2 should work in 99% of the cases, because for the most part Ubuntu users use NetworkManager, unless the user is usingwicd
or command-line only method. @freude do you have it listed with a different starting number perhaps ?
– Sergiy Kolodyazhnyy
Oct 31 '15 at 14:51
1
@Serg It's virtual; it never really exists. The files are coming from inside the house, etc. Same with things like/dev
,/proc
,/run
.
– Oli♦
Oct 31 '15 at 15:02
4
/sys
is virtual. It does not exist on disk. You should remove #4 from the list.
– Andrew Medico
Oct 31 '15 at 19:49
4
4
/sys/
isn't real so may not exist in the clone. Option 2 only works if you specify which adapter a connection should connect on. Option 3 requires your last boot to have been fairly successful. Option 1 is the best bet.– Oli♦
Oct 31 '15 at 14:44
/sys/
isn't real so may not exist in the clone. Option 2 only works if you specify which adapter a connection should connect on. Option 3 requires your last boot to have been fairly successful. Option 1 is the best bet.– Oli♦
Oct 31 '15 at 14:44
The second option works for me. Strange, but I don't have file 70-persistent-net.rules in my filesystem
– freude
Oct 31 '15 at 14:47
The second option works for me. Strange, but I don't have file 70-persistent-net.rules in my filesystem
– freude
Oct 31 '15 at 14:47
Option #2 should work in 99% of the cases, because for the most part Ubuntu users use NetworkManager, unless the user is using
wicd
or command-line only method. @freude do you have it listed with a different starting number perhaps ?– Sergiy Kolodyazhnyy
Oct 31 '15 at 14:51
Option #2 should work in 99% of the cases, because for the most part Ubuntu users use NetworkManager, unless the user is using
wicd
or command-line only method. @freude do you have it listed with a different starting number perhaps ?– Sergiy Kolodyazhnyy
Oct 31 '15 at 14:51
1
1
@Serg It's virtual; it never really exists. The files are coming from inside the house, etc. Same with things like
/dev
, /proc
, /run
.– Oli♦
Oct 31 '15 at 15:02
@Serg It's virtual; it never really exists. The files are coming from inside the house, etc. Same with things like
/dev
, /proc
, /run
.– Oli♦
Oct 31 '15 at 15:02
4
4
/sys
is virtual. It does not exist on disk. You should remove #4 from the list.– Andrew Medico
Oct 31 '15 at 19:49
/sys
is virtual. It does not exist on disk. You should remove #4 from the list.– Andrew Medico
Oct 31 '15 at 19:49
|
show 4 more comments
On Ubuntu server 18.04, I found the MAC address in /var/log/syslog
and /var/log/ufw.log
as :
Dec 7 02:49:08 hostname kernel: [1870435.881302] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.114.154 DST=XXX.YYY.138.47 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=54321 PROTO=TCP SPT=40963 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0
Dec 7 02:54:32 hostname kernel: [1870760.588719] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.25.65 DST=XXX.YYY.138.47 LEN=44 TOS=0x00 PREC=0x00 TTL=56 ID=36934 PROTO=TCP SPT=2740 DPT=80 WINDOW=35007 RES=0x00 SYN URGP=0
Dec 7 03:01:22 hostname kernel: [1871170.660324] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.106.221 DST=XXX.YYY.138.47 LEN=40 TOS=0x00 PREC=0x00 TTL=237 ID=1440 PROTO=TCP SPT=58914 DPT=80 WINDOW=1024 RES=0x00 SYN URGP=0
Using this answer to parse the log, the desired MAC address is:
xx:yy:2b:49:c7:23
add a comment |
On Ubuntu server 18.04, I found the MAC address in /var/log/syslog
and /var/log/ufw.log
as :
Dec 7 02:49:08 hostname kernel: [1870435.881302] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.114.154 DST=XXX.YYY.138.47 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=54321 PROTO=TCP SPT=40963 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0
Dec 7 02:54:32 hostname kernel: [1870760.588719] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.25.65 DST=XXX.YYY.138.47 LEN=44 TOS=0x00 PREC=0x00 TTL=56 ID=36934 PROTO=TCP SPT=2740 DPT=80 WINDOW=35007 RES=0x00 SYN URGP=0
Dec 7 03:01:22 hostname kernel: [1871170.660324] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.106.221 DST=XXX.YYY.138.47 LEN=40 TOS=0x00 PREC=0x00 TTL=237 ID=1440 PROTO=TCP SPT=58914 DPT=80 WINDOW=1024 RES=0x00 SYN URGP=0
Using this answer to parse the log, the desired MAC address is:
xx:yy:2b:49:c7:23
add a comment |
On Ubuntu server 18.04, I found the MAC address in /var/log/syslog
and /var/log/ufw.log
as :
Dec 7 02:49:08 hostname kernel: [1870435.881302] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.114.154 DST=XXX.YYY.138.47 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=54321 PROTO=TCP SPT=40963 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0
Dec 7 02:54:32 hostname kernel: [1870760.588719] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.25.65 DST=XXX.YYY.138.47 LEN=44 TOS=0x00 PREC=0x00 TTL=56 ID=36934 PROTO=TCP SPT=2740 DPT=80 WINDOW=35007 RES=0x00 SYN URGP=0
Dec 7 03:01:22 hostname kernel: [1871170.660324] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.106.221 DST=XXX.YYY.138.47 LEN=40 TOS=0x00 PREC=0x00 TTL=237 ID=1440 PROTO=TCP SPT=58914 DPT=80 WINDOW=1024 RES=0x00 SYN URGP=0
Using this answer to parse the log, the desired MAC address is:
xx:yy:2b:49:c7:23
On Ubuntu server 18.04, I found the MAC address in /var/log/syslog
and /var/log/ufw.log
as :
Dec 7 02:49:08 hostname kernel: [1870435.881302] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.114.154 DST=XXX.YYY.138.47 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=54321 PROTO=TCP SPT=40963 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0
Dec 7 02:54:32 hostname kernel: [1870760.588719] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.25.65 DST=XXX.YYY.138.47 LEN=44 TOS=0x00 PREC=0x00 TTL=56 ID=36934 PROTO=TCP SPT=2740 DPT=80 WINDOW=35007 RES=0x00 SYN URGP=0
Dec 7 03:01:22 hostname kernel: [1871170.660324] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.106.221 DST=XXX.YYY.138.47 LEN=40 TOS=0x00 PREC=0x00 TTL=237 ID=1440 PROTO=TCP SPT=58914 DPT=80 WINDOW=1024 RES=0x00 SYN URGP=0
Using this answer to parse the log, the desired MAC address is:
xx:yy:2b:49:c7:23
answered Dec 10 '18 at 11:14
Eric DuminilEric Duminil
33317
33317
add a comment |
add a comment |
You can get it from arp cache
cat /proc/net/arp
New contributor
add a comment |
You can get it from arp cache
cat /proc/net/arp
New contributor
add a comment |
You can get it from arp cache
cat /proc/net/arp
New contributor
You can get it from arp cache
cat /proc/net/arp
New contributor
New contributor
answered 5 mins ago
Arun PradeepArun Pradeep
1
1
New contributor
New contributor
add a comment |
add a comment |
Thanks for contributing an answer to Ask Ubuntu!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f692258%2ffind-mac-address-in-the-filesystem%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown