My laptop is down, but I need to extract its MAC address thas was previously used to establish wifi connection. The filesystem was cloned, so I am trying to find any configurational file which contains the string with MAC address. What file is usually red by ifconfig to display network interfaces information?
/etc/NetworkManager/system-connections directory, inspect any of the files for connections listed there.
/var/log/syslog file and archived ones,
syslog.*.gz. Specifically, look for something in format
date hostname dhclient: Listening on LPF/wlan0/XX:XX:XX:XX:XX:XX
Option 4: May be listed in
dmesg log as well, however at least for me personally, it took form without
: as separator. Here's what I mean
[ 5.655159] ieee80211 phy0: hwaddr b482fed38556, RTL8187SE + rtl8225-se
side note: since
/sys filesystem exists only at runtime , as does
/proc , it's impossible to view
/sys/class/net/wlan0/address file, however I will leave that as side note, in case one needs a file usable at run-time.
On Ubuntu server 18.04, I found the MAC address in
/var/log/ufw.log as :
Dec 7 02:49:08 hostname kernel: [1870435.881302] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.114.154 DST=XXX.YYY.138.47 LEN=40 TOS=0x00 PREC=0x00 TTL=246 ID=54321 PROTO=TCP SPT=40963 DPT=80 WINDOW=65535 RES=0x00 SYN URGP=0 Dec 7 02:54:32 hostname kernel: [1870760.588719] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.25.65 DST=XXX.YYY.138.47 LEN=44 TOS=0x00 PREC=0x00 TTL=56 ID=36934 PROTO=TCP SPT=2740 DPT=80 WINDOW=35007 RES=0x00 SYN URGP=0 Dec 7 03:01:22 hostname kernel: [1871170.660324] [UFW BLOCK] IN=eno1 OUT= MAC=xx:yy:2b:49:c7:23:aa:bb:00:00:00:1a:08:00 SRC=XXX.YYY.106.221 DST=XXX.YYY.138.47 LEN=40 TOS=0x00 PREC=0x00 TTL=237 ID=1440 PROTO=TCP SPT=58914 DPT=80 WINDOW=1024 RES=0x00 SYN URGP=0
Using this answer to parse the log, the desired MAC address is:
You can get it from arp cache