Finding more info from an IP

PaulStat · 29 Aug 2006 at 13:45

One of the computers in our office seems to be causing trouble with the firewall. We have the IP but have no idea where the computer actually is, is there some kind of command prompt to get more details about an IP? Such as computer name etc.?

Isn't there a command that can send a message to an IP and it will appear as a popup window on that computers screen?

Biffa · 29 Aug 2006 at 15:49

Try an IP Scanner like : http://www.radmin.com/products/utilities/ipscanner.php

The_KiD · 29 Aug 2006 at 15:57

Code:

ping -a 192.168.0.1

Should reveal the machine name, but change 192.168.0.1 to your machines Ip.

also to send the message:

Code:

net send 192.168.0.1 Blah blah blah

again changing the IP.

If you suspect it to be the user, then ban it's IP from the network and see who comes up to complain.

Phemo · 29 Aug 2006 at 16:57

Note that XP SP2 disabled the messenger service so if it's an XP SP2 machine then net sends are not going to work.

FordPrefect · 29 Aug 2006 at 19:47

If the machine in question is a windows machine try using the command nbtstat -r <IP addy> should hopefully give you the netbios name of the machine in question but also the username of whoever is currently logged in.

Failing that if you have a managed switch you can always get the arp address from the firewall arp cache, and check the switch cam tables to see which switch port the computer is plugged into, and trace the patching from there.