There is a number of possible solutions for your problem.
- You could read the configuration file and the lease file of the DHCP server, and find out the IP <-> MAC address associations from there.
For example, with an ISC DHCP server, you'd find any permanently-via-DHCP assigned IP addresses in the DHCP configuration file /etc/dhcp/dhcpd.conf:
host bmcname {
hardware ethernet 12:34:56:78:90:ab;
fixed-address 192.168.12.34;
...
And any non-permanent assignments in the DHCP lease file /var/lib/dhcp/dhcpd.leases:
lease 192.168.12.48 {
starts 5 2024/09/27 05:22:47;
ends 5 2024/09/27 13:22:47;
cltt 5 2024/09/27 05:22:47;
binding state active;
next binding state free;
rewind binding state free;
hardware ethernet 23:45:67:89:0a:bc;
...
- After running
arp-scan, you could ping an IP address (or do anything else that causes traffic sent to it) from any system in the same network segment, then if the target IP address responds to ping, immediately afterwards run arp -a to view the local ARP table.
$ ping -c 1 192.168.12.34 >/dev/null # just to create some traffic
$ /sbin/arp -a | grep 192.168.12.34
bmc.server.name (192.168.12.34) at 12:34:56:78:90:ab [ether] on eno1
- You could install the
ipmiutil package, run ipmiutil discover and get a list of all IP addresses responding to IPMI requests (i.e. the BMC interfaces) together with their BMC-configured hostnames.
Example with just one BMC:
$ ipmiutil discover
idiscover ver 1.11
Discovering IPMI Devices:
01| response from | 192.168.12.34 | bmc.server.name
idiscover: 1 pings sent, 1 responses
ipmiutil discover, completed successfully