captive: Get MAC address of a device without calling arp