+ Post New Thread
Results 1 to 12 of 12
How do you do....it? Thread, Unknown network device in Technical; Is there a way of searching the network looking for a mac address? My network monitor is displaying a device, ...
  1. #1
    leco's Avatar
    Join Date
    Nov 2006
    Location
    West Yorkshire
    Posts
    2,026
    Thank Post
    595
    Thanked 125 Times in 119 Posts
    Rep Power
    41

    Unknown network device

    Is there a way of searching the network looking for a mac address? My network monitor is displaying a device, which it says has no IP address but does have a mac address.

    I didn't think that devices could be on a network without an IP so that shows how much I know.

  2. #2


    Join Date
    Feb 2007
    Location
    Northamptonshire
    Posts
    4,690
    Thank Post
    352
    Thanked 796 Times in 715 Posts
    Rep Power
    347
    Without wishing to appear pedantic, try googling the first bit of the MAC as it may well reveal the manufacturer of said hardware.

  3. Thanks to kmount from:

    leco (7th January 2009)

  4. #3

    matt40k's Avatar
    Join Date
    Jun 2008
    Location
    Ipswich
    Posts
    4,407
    Thank Post
    368
    Thanked 639 Times in 521 Posts
    Rep Power
    158
    Few ideas:

    Check DHCP, might be trying to get an IP.
    ARP to assign it an ip.
    Check the switches (wlan) for actual location.
    Try and work out the manufacturer of the device then work from there.
    Wireshark, see if it's transmitting anything.

  5. #4
    Zimmer's Avatar
    Join Date
    Nov 2008
    Location
    Chadderton
    Posts
    116
    Thank Post
    10
    Thanked 10 Times in 10 Posts
    Rep Power
    13
    Quote Originally Posted by matt40k View Post
    Few ideas:

    Check DHCP, might be trying to get an IP.
    ARP to assign it an ip.
    Check the switches (wlan) for actual location.
    Try and work out the manufacturer of the device then work from there.
    Wireshark, see if it's transmitting anything.
    I agree with Matt, checking ARP table records is a good one, and DHCP lease history is a good one too - Failing that Wiresharking will probably help you find out a fair bit of info about the device.

    Also try Telnet, HTTP(s), FTP, SNMP trapping, SSHing to the device?

  6. #5

    FN-GM's Avatar
    Join Date
    Jun 2007
    Location
    UK
    Posts
    15,948
    Thank Post
    886
    Thanked 1,697 Times in 1,475 Posts
    Blog Entries
    12
    Rep Power
    447
    Quote Originally Posted by kmount View Post
    Without wishing to appear pedantic, try googling the first bit of the MAC as it may well reveal the manufacturer of said hardware.
    I have seen a website that when you type the mac address in it will reveal the manufctorer of the device

  7. #6
    Zimmer's Avatar
    Join Date
    Nov 2008
    Location
    Chadderton
    Posts
    116
    Thank Post
    10
    Thanked 10 Times in 10 Posts
    Rep Power
    13
    Quote Originally Posted by FN-GM View Post
    I have seen a website that when you type the mac address in it will reveal the manufctorer of the device
    Is this the one.... Vendor/Ethernet/Bluetooth MAC Address Lookup and Search

  8. Thanks to Zimmer from:

    leco (7th January 2009)

  9. #7

    FN-GM's Avatar
    Join Date
    Jun 2007
    Location
    UK
    Posts
    15,948
    Thank Post
    886
    Thanked 1,697 Times in 1,475 Posts
    Blog Entries
    12
    Rep Power
    447
    Thats the one

  10. #8


    tom_newton's Avatar
    Join Date
    Sep 2006
    Location
    Leeds
    Posts
    4,473
    Thank Post
    866
    Thanked 848 Times in 670 Posts
    Rep Power
    196
    Some switches will list their arp table - and tell you which port the device is on. Start at the core switch and wait til that MAC is the only one on a port.

  11. #9

    matt40k's Avatar
    Join Date
    Jun 2008
    Location
    Ipswich
    Posts
    4,407
    Thank Post
    368
    Thanked 639 Times in 521 Posts
    Rep Power
    158
    Is prob someone's laptop\router with a static IP if nothings in the DHCP logs.

  12. #10
    leco's Avatar
    Join Date
    Nov 2006
    Location
    West Yorkshire
    Posts
    2,026
    Thank Post
    595
    Thanked 125 Times in 119 Posts
    Rep Power
    41
    OK I don't know what wireshark is. Where do I look for arp?
    zimmer - Thanks for the link, have used that to find the address is a netgear device. So I'm guessing it is an access point.
    tom_newton - sorry I don't understand what you are suggesting.

    I apologise if this is a set of stupid questions but I actually thought that Edugeek was the place to ask about such things. After all if I don't know what the issue is then by Googling I would not know which resolution to follow.

  13. #11

    matt40k's Avatar
    Join Date
    Jun 2008
    Location
    Ipswich
    Posts
    4,407
    Thank Post
    368
    Thanked 639 Times in 521 Posts
    Rep Power
    158
    Google wireshark, it's a program that displays current network traffic.

    As it's netgear it could be a wireless\network card, but most likely some smartarse has plugged in a wireless access point.

    As tom has pointed out your switches, if they are managed will be able to tell you which point has it plugged in. If you can't be arsed\don't have managed switches, you'll need to go walk around your site looking for a netgear wireless access point \ router \ or such plugged into your network.

    As you've not had any DHCP issues, you've prob got a Wireless access point with a static ip on a different address (ie 192.168.1.x when your network is 10.0.0.x).

    I believe there is a netgear search tool. Not sure tho.

  14. Thanks to matt40k from:

    leco (7th January 2009)

  15. #12
    leco's Avatar
    Join Date
    Nov 2006
    Location
    West Yorkshire
    Posts
    2,026
    Thank Post
    595
    Thanked 125 Times in 119 Posts
    Rep Power
    41
    Quote Originally Posted by matt40k View Post
    Google wireshark, it's a program that displays current network traffic.
    Thanks for this, I'll have a look for it.

    As it's netgear it could be a wireless\network card, but most likely some smartarse has plugged in a wireless access point.

    As tom has pointed out your switches, if they are managed will be able to tell you which point has it plugged in. If you can't be arsed\don't have managed switches, you'll need to go walk around your site looking for a netgear wireless access point \ router \ or such plugged into your network.
    Only one of the switches is managed I believe. I've never really had cause to look at it. I obviously have work to do on that score, thanks. The router is a Cisco that's why I thought access point.

    As you've not had any DHCP issues, you've prob got a Wireless access point with a static ip on a different address (ie 192.168.1.x when your network is 10.0.0.x).

    I believe there is a netgear search tool. Not sure tho.
    Since the network monitor is only looking for a 10. range this seems possible. Thanks again I'll have a look for a Netgear tool.

SHARE:
+ Post New Thread

Similar Threads

  1. Disable Network Device
    By FN-GM in forum Scripts
    Replies: 2
    Last Post: 10th December 2008, 12:57 PM
  2. Unknown RAM usage.
    By Trenton_Lister in forum Windows Vista
    Replies: 7
    Last Post: 30th September 2008, 02:28 PM
  3. Small cheap network device with basic webserver?
    By pete in forum Wireless Networks
    Replies: 1
    Last Post: 13th June 2008, 09:08 AM
  4. Unknown Messages
    By dryhammer in forum Thin Client and Virtual Machines
    Replies: 2
    Last Post: 7th May 2008, 08:42 AM
  5. unknown model!?
    By browolf in forum Hardware
    Replies: 5
    Last Post: 4th April 2008, 01:56 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •