Terminal & tcpdump

tcpdump is not likely to help you.

First of all, MAC addresses are only relevant on local networks - you can see the MAC address of any device on your local network - printers, routers, switches, other computers, etc. - but you can't see MAC addresses of remote devices. So having the MAC address isn't going to help you unless the device is plugged into you local network (in which case it probably isn't stolen).

So next down the list is IP address. You're unlikely to be able to trace it from there because any internal/private IP address used inside your LAN (e.g. 192.168.x.x or 10.x.x.x) wouldn't be visible publicly. If the device was connected to the internet you'd see it's IP address, so the issue is really identifying this machine, but you don't know what IP address it would be using.

Now, if the machine was configured to talk to your server (e.g. to retrieve mail) then you may be able to trace it via the mail logs, but that's a far easier proposition than tcpdump. You have to hope, of course, that whoever stole it is stupid enough to connect it to the internet before wiping the hard drive and re-installing a clean OS. If that's happened you have almost no way of tracing the machine remotely.
There are third-party packages that can do this, but they work by pre-installing software on the machine that periodically calls home (to the vendor), and it's installed in such a way it's hard to circumvent. If you don't have such software installed you're likely out of luck, sorry.

Something along the lines of the following will show you all packets that originate from the machine with the MAC address of 00:1f:5b:80:77:0f and which are passing through the machine you run the command on.

+sudo tcpdump ether src host 00:1f:5b:80:77:0f+

There are a couple of things you should consider with this:

1) When asked for your password you should enter your login password - you must have an administrator account to run tcpdump.

2) You may need to specify the correct interface to tcpdump. You can list all interfaces by running ifconfig in the terminal. For example, on my computer en0 is the wireless card, to force tcpdump to use it I would need to specify it like this: +sudo tcpdump -i en0 ether src host 00:1f:5b:80:77:0f+

Finally, and this is crucial:

3) MAC addresses are only carried between two links on a network. IP addresses are designed for routing across multiple links. This means that if your stolen laptop is being used wirelessly, its MAC address won't be in the packet beyond the wireless base station:

Stolen Laptop
00:00:00:00:00:01
|
|
Base Station
00:00:00:00:00:02
|
|
|
Listening Computer
00:00:00:00:00:03

In this scenario the listening computer would see only packets with the src address of 00:00:00:00:00:02.

Another method may be to poll your arp table for the presence of either of these MAC addresses. On a large network this may not be an option (routers may not forward broadcast, etc.) but it's worth a try:
<pre style="padding-left: .75ex; padding-top: .25em; padding-bottom: .25em; margin-top: .5em; margin-bottom: .5em; margin-left: 1ex; max-width: 80ex; overflow: auto; font-size: 10px; font-family: Monaco, 'Courier New', Courier, monospace; color: #444; background: #eee; line-height: normal">#!/bin/sh

ping -c1 `ifconfig | sed -ne '/broadcast/ s/.* \(.*\)/\1/p'` >/dev/null
RSLT=`arp -an | egrep "$1"`

if [ "$RSLT" ] ; then
echo `date` Found: $RSLT # Maybe pipe to email and/or log.
fi
</pre>
The following for a couple known hosts on my network:
<pre style="padding-left: .75ex; padding-top: .25em; padding-bottom: .25em; margin-top: .5em; margin-bottom: .5em; margin-left: 1ex; max-width: 80ex; overflow: auto; font-size: 10px; font-family: Monaco, 'Courier New', Courier, monospace; color: #444; background: #eee; line-height: normal">checkmac ' 0:10:20:30:40:50 | 60:70:80:90:a0:b0 '</pre>
Returns:
<pre style="padding-left: .75ex; padding-top: .25em; padding-bottom: .25em; margin-top: .5em; margin-bottom: .5em; margin-left: 1ex; max-width: 80ex; overflow: auto; font-size: 10px; font-family: Monaco, 'Courier New', Courier, monospace; color: #444; background: #eee; line-height: normal">Tue Aug 26 09:55:06 EDT 2008 Found: ? (192.168.1.3) at 0:10:20:30:40:50 on en0 [ethernet] ? (192.168.1.16) at 60:70:80:90:a0:b0 on en0 [ethernet]
</pre>
--
Cole

As per my original post, I am only concerned with trying to track it WITHIN the local network

OK, it wasn't clear to me that you expected the machine to connect to your network.

It is a school

Ahh, that makes a whole lot of difference 🙂

I am open to suggestion as to ANY software which may be able to detect MAC addresses locally

Since your system will only see the MAC address if the machine in question directly contacts it, MAC addresses may not be the way to go. A broadcast ping may help but not everything will respond to a broadcast ping.

Instead I suggest checking your switches. By definition every switch needs to know where every MAC address is. The switch should have some command such as 'show mac' which will show each MAC address it knows as well as which port to use to get to it. Depending on your network topology that port may link to a base station or another switch. If it's another switch, just follow the chain until you narrow down where it is. Depending on your base station, you may also be able to query it for MAC addresses that it is servicing.

This approach has two significant advantages over MAC tracing via tcpdump.
First of all, they can't hide (switched networks depend on MAC address tables).
Secondly, thanks to arp caches, the switch will remember a MAC for a period of time - typically measured in minutes - which may enable you to narrow down the machine's location even if it's just been turned off.