Can I get MAC addresses of devices (mobile phones) which are near to my network but not connected to it? (Linux)

I have been trying to get the MAC addresses of devices connected to my network through nmap command... but how can I get devices which are not connected to my network?

3 Answers 3


If it's not in the same network, you most likely won't be able to.

MAC addresses are hardware addresses and are usually hidden behind a router unless you are on the same network or have direct access to the device. In other words, once you leave the network, unless the device(s) in question is/are directly connected to a router you will get the MAC address of the switch rather than the individual devices when querying that network.

Depending on the security of your network, you may not even be able to get the MAC addresses of devices on the same switch since they may be on different VLANs.

With that said, in your comment you asked if you could get any other information on the device(s). Without access to the network that the device is on it's pretty difficult to get any information on anything other than that of the router. Without getting too technical, unless the device has its own static IP address that you know, which is unlikely for a mobile device, if you query the network from the outside you'll get the public IP of the router, not the devices. Specifically for mobile phones, you can probably get information via Bluetooth if it's enabled on the device, but you have to be in close proximity. According to one commenter it may also be possible to sniff the device's traffic given close enough proximity. There are probably ways to gather more info, but it's probably more trouble than it's worth.

The easiest way to get information on a device on a different network is to simply join that network.

Edit: As you say in another comment, you have a WiFi adapter that someone can connect to. If the device doesn't connect to that adapter, then you can't gather any information about the device. But if the device does connect to your WiFi adapter, if it's assigning IP addresses, you will be able to see both the MAC address and the IP address you assigned, and with the MAC address you can infer roughly what kind of device it is based off the manufacturer's portion of the MAC address. If you're letting the device access the Internet, you will also be able to see all of the packets it sends through your adapter. You may be able to get some additional information specifically about the device, but it depends on the device, your WiFi adapter, the software you're using... and so on, which means there are many variables.

  • 1
    It should be noted that the switch in this answer needs to be a layer 3 switch in order to hide MAC addresses. A typical layer 2 switch will not hide MAC addresses.
    – AndrejaKo
    Mar 24, 2014 at 9:58
  • I thought that the layer 2 switch would only show its MAC address at the link to the router? It's a little fuzzy for me, but I thought that the switch doesn't pass along the device's MAC address to the router, only its own. I'll edit if that's not the case.
    – josh
    Mar 24, 2014 at 10:03
  • Layer two switch will not change the IP address used. You can easily check that for yourself. Go to any Unix or Windows computer connected to a switch, fire up terminal and run arp -a and you'll see MAC addresses of other devices connected to the same switch. ARP maps the IP addresses to MAC addresses and MAC addresses are used to actually communicate within network. When a device needs to talk outside of its subnet, it will use IP address of the receiving side and the MAC address of the default gateway. The router/L3 switch will change the MAC address, but it will not change the IP address.
    – AndrejaKo
    Mar 24, 2014 at 10:19
  • Also do feel free to fire up Wireshark and scan some packets coming into your computer. You should easily see that all the packets from the Internet have MAC address of your router, while all packets from the local subnet have MAC addresses of actual devices used. It can be very educational and can clear up some fuzziness.
    – AndrejaKo
    Mar 24, 2014 at 10:21
  • Yes, but doesn't a layer 2 switch keep a ARP table to map MAC addresses to the next layer's address, generally an IP address? What I was saying was that a switch will not show a connected device's MAC address, but its own, except when you are on the same network and VLAN, which means that an outside user won't be able to get the MAC addresses of the devices inside.
    – josh
    Mar 24, 2014 at 10:31

It is possible to find the MAC addresses of devices that are physically close to you if they have wifi enabled.

When a device sends data packets over wifi they are stamped with the sender's MAC address and the destination MAC address (typically a wireless router). The contents of the packet will most likely be encrypted through WPA or WEP etc. but the MAC addresses cannot be. Think of it like a sealed letter with an address on it.

It does not matter if you are not on the same network because the packets are literally traveling through the air and in all directions. You may not be able to read the contents of the packets or interact with the sender if you are not on the same network but nothing is stopping you from viewing them.

This is why it is important to be careful on unsecured wireless networks with no encryption.

One tool that will help you capture and display this data is called airodump-ng.

Even if a device is not connected to a wireless network, it may still be "probing" to find out if it is range of a network it was previously connected to.


If you're trying to get the MAC address of Wi-Fi access points, you can run sudo iwlist scanning, and look for the ESSID of the device that interests you.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .