in reply to mac to IP address?

I could be way, way off base here but I'd ask how the ARP (address resolution protocol) works. If you've every used:
tcpdump -p arp tcpdump: listening on eth0 10:30:43.935182 arp who-has 192.168.1.20 tell 192.168.1.1 10:30:43.935423 arp reply 192.168.1.20 is-at 0:d:60:11:60:80
you can see the 'who-has' request, followed by the 'reply'.
Maybe NetPacket::ARP can help you with this.