Unknown network device

[leco]

Is there a way of searching the network looking for a mac address? My network monitor is displaying a device, which it says has no IP address but does have a mac address.

I didn't think that devices could be on a network without an IP so that shows how much I know.

[kmount]

Without wishing to appear pedantic, try googling the first bit of the MAC as it may well reveal the manufacturer of said hardware.

[matt40k]

Few ideas:

Check DHCP, might be trying to get an IP.
ARP to assign it an ip.
Check the switches (wlan) for actual location.
Try and work out the manufacturer of the device then work from there.
Wireshark, see if it's transmitting anything.

[Zimmer]

Few ideas:

Check DHCP, might be trying to get an IP.
ARP to assign it an ip.
Check the switches (wlan) for actual location.
Try and work out the manufacturer of the device then work from there.
Wireshark, see if it's transmitting anything.

I agree with Matt, checking ARP table records is a good one, and DHCP lease history is a good one too - Failing that Wiresharking will probably help you find out a fair bit of info about the device.

Also try Telnet, HTTP(s), FTP, SNMP trapping, SSHing to the device?

[FN-GM]

Without wishing to appear pedantic, try googling the first bit of the MAC as it may well reveal the manufacturer of said hardware.

I have seen a website that when you type the mac address in it will reveal the manufctorer of the device

[Zimmer]

I have seen a website that when you type the mac address in it will reveal the manufctorer of the device

Is this the one.... Vendor/Ethernet/Bluetooth MAC Address Lookup and Search

[FN-GM]

Thats the one

[tom_newton]

Some switches will list their arp table - and tell you which port the device is on. Start at the core switch and wait til that MAC is the only one on a port.

[matt40k]

Is prob someone's laptop\router with a static IP if nothings in the DHCP logs.

[leco]

OK I don't know what wireshark is. Where do I look for arp?
zimmer - Thanks for the link, have used that to find the address is a netgear device. So I'm guessing it is an access point.
tom_newton - sorry I don't understand what you are suggesting.

I apologise if this is a set of stupid questions but I actually thought that Edugeek was the place to ask about such things. After all if I don't know what the issue is then by Googling I would not know which resolution to follow.

[matt40k]

Google wireshark, it's a program that displays current network traffic.

As it's netgear it could be a wireless\network card, but most likely some smartarse has plugged in a wireless access point.

As tom has pointed out your switches, if they are managed will be able to tell you which point has it plugged in. If you can't be arsed\don't have managed switches, you'll need to go walk around your site looking for a netgear wireless access point \ router \ or such plugged into your network.

As you've not had any DHCP issues, you've prob got a Wireless access point with a static ip on a different address (ie 192.168.1.x when your network is 10.0.0.x).

I believe there is a netgear search tool. Not sure tho.

[leco]

Google wireshark, it's a program that displays current network traffic.

Thanks for this, I'll have a look for it.

As it's netgear it could be a wireless\network card, but most likely some smartarse has plugged in a wireless access point.

As tom has pointed out your switches, if they are managed will be able to tell you which point has it plugged in. If you can't be arsed\don't have managed switches, you'll need to go walk around your site looking for a netgear wireless access point \ router \ or such plugged into your network.

Only one of the switches is managed I believe. I've never really had cause to look at it. I obviously have work to do on that score, thanks. The router is a Cisco that's why I thought access point.

As you've not had any DHCP issues, you've prob got a Wireless access point with a static ip on a different address (ie 192.168.1.x when your network is 10.0.0.x).

I believe there is a netgear search tool. Not sure tho.

Since the network monitor is only looking for a 10. range this seems possible. Thanks again I'll have a look for a Netgear tool.