Finding a device with a certain IP

--Mike--

--Mike--

--Mike--

Associate
Joined
10 Aug 2006
Posts
801
Location
Northampton
Hi folks

Here at work there is a device on the network with an IP address that isn't from the DHCP pool ie. has been manually configured.

Is there a way to actually find out what this device is because I can't think what it would be.

Typing the IP into a browser brings up a 404 error, and telnet doesn't bring up anything either.

IPScan alerted me to it, but the hostname is just some squiggles!!

Any ideas? Cheers.
 
--Mike-- said:
Hi folks

Here at work there is a device on the network with an IP address that isn't from the DHCP pool ie. has been manually configured.

Is there a way to actually find out what this device is because I can't think what it would be.

Typing the IP into a browser brings up a 404 error, and telnet doesn't bring up anything either.

IPScan alerted me to it, but the hostname is just some squiggles!!

Any ideas? Cheers.
Click to expand...

Shutdown all the machines.
Send a Wake packet to the IP in question
Look for the machine that's booted.
 
Visage said:
Shutdown all the machines.
Send a Wake packet to the IP in question
Look for the machine that's booted.
Click to expand...

Might have to do that when I've got the network to myself. That or ping it -t and unplug fibre patch leads until it stops replying and track it down by location at least!!
 
ping it
then do an arp -a to find the MAC address

from the first 6 digits you should be able to find out the manufacturer of the NIC

http://www.coffer.com/mac_find/

MAY help you determine what type of device it is eg Compaq, HP, IBM, Cisco

of course you may find it is a generic broadcom which will be no help at all!

uu
 
You could try remote desktop to it (mstsc from start -> run) which may get you to it's logon window even if you can't logon.
 
depending on the swich(es) you have

ping it
arp -a to get the mac
Look in the mac table of the switches and see where its plugged in, unplug it and see who shouts
 
netscan>find it's MAC

change your MAC to the same

wait for someone to complain that they got kicked off the internet ;)
 
if it does ping..

do this when no-one else is working, otherwise it'd cause distruption :D

shut down all machines you can
and leave it pinging the ip

ping -t IP

now unplug cables which are still flashing in the switch until you find out which one makes it stop pinging

then trace the cable to the port number
 
Once you have it's mac address you should be able to find out which port it is plugged into on your switch (as long as it's managed) and then trace it through the patch panel to see which floor / wall port it's plugged into.

What happens when you net view it?
 
If you have access to nmap(I use it on a Linux box) you can do a scan of the IP and say tell it to do a fingerprint test.

If the box has any ports open nmap will give a guess to what the OS is of your mystery box.
Couple that with what others have said about getting MAC addresses you should get to it in the end!
 
I think I've tracked it down to a Canon photocopier!!! I found nmap and it reported a Canon machine being the most likely device. Got to ping it -t and then unplug it.

Cheers for all your help - I've learned new things.
 
You must log in or register to reply here.
Back
Top Bottom