Penetration Testing: [PEN-TEST] MAC -> IP ?

["Kerle, Jens" <jkerle () GMX DE>]

Hi,

i am watching our net for changes in IP and MAC (which we don't allow). On
out Switch i can find a MAC, with no known IP. I already tried to ping the
whole IP range and looked in the arp table of my computer, but can't find
the MAC there. If i flush the switch arp table, the MAC comes back after
some seconds, so the 'evil' computer seems to be active.

1. is there a better way to get the IP if i have the MAC ?

2. how is it possible to hide your arp requests/response ?

thanks, Jens