howto get ip using mac address with tcpdump
tcpdump -ennqti eth0 \( arp or icmp \) | grep "00.17.a4.e0.39.a6" tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes 00:17:a4:e0:39:a6 > ff:ff:ff:ff:ff:ff, ARP, length 42: Request who-has 10.1.10.255 tell 10.1.10.119, length 28 00:18:8b:e1:7a:74 > 00:17:a4:e0:39:a6, ARP, length 60: Reply 10.1.10.255 is-at 00:18:8b:e1:7a:74, length 46 00:17:a4:e0:39:a6 > ff:ff:ff:ff:ff:ff, ARP, length 42: Request who-has 10.3.4.193 tell 10.1.10.119, length 28 00:1c:c0:e2:d8:68 > 00:17:a4:e0:39:a6, ARP, length 60: Reply 10.3.4.193 is-at 00:1c:c0:e2:d8:68, length 46 00:17:a4:e0:39:a6 > 00:1c:c0:e2:d8:68, ARP, length 42: Reply 10.1.10.119 is-at 00:17:a4:e0:39:a6, length 28 00:17:a4:e0:39:a6 > 00:18:8b:e1:7a:74, ARP, length 42: Request who-has 10.1.10.255 tell 10.1.10.119, length 28 00:18:8b:e1:7a:74 > 00:17:a4:e0:39:a6, ARP, length 60: Reply 10.1.10.255 is-at 00:18:8b:e1:7a:74, length 46 00:17:a4:e0:39:a6 > 00:18:8b:e1:7a:74, ARP, length 42: Request who-has 10.1.10.255 tell 10.1.10.119, length 28 00:18:8b:e1:7a:74 > 00:17:a4:e0:39:a6, ARP, length 60: Reply 10.1.10.255 is-at 00:18:8b:e1:7a:74, length 46 00:17:a4:e0:39:a6 > 00:18:8b:e1:7a:74, ARP, length 42: Request who-has 10.1.10.255 tell 10.1.10.119, length 28 00:18:8b:e1:7a:74 > 00:17:a4:e0:39:a6, ARP, length 60: Reply 10.1.10.255 is-at 00:18:8b:e1:7a:74, length 46 00:17:a4:e0:39:a6 > 00:18:8b:e1:7a:74, ARP, length 42: Request who-has 10.1.10.255 tell 10.1.10.119, length 28 00:18:8b:e1:7a:74 > 00:17:a4:e0:39:a6, ARP, length 60: Reply 10.1.10.255 is-at 00:18:8b:e1:7a:74, length 46