+ Post New Thread
Results 1 to 12 of 12
How do you do....it? Thread, Unknown network device in Technical; Is there a way of searching the network looking for a mac address? My network monitor is displaying a device, ...
  1. #1
    leco's Avatar
    Join Date
    Nov 2006
    Location
    West Yorkshire
    Posts
    2,026
    Thank Post
    595
    Thanked 125 Times in 119 Posts
    Rep Power
    42

    Unknown network device

    Is there a way of searching the network looking for a mac address? My network monitor is displaying a device, which it says has no IP address but does have a mac address.

    I didn't think that devices could be on a network without an IP so that shows how much I know.

  2. #2


    Join Date
    Feb 2007
    Location
    Northamptonshire
    Posts
    4,706
    Thank Post
    354
    Thanked 807 Times in 722 Posts
    Rep Power
    348
    Without wishing to appear pedantic, try googling the first bit of the MAC as it may well reveal the manufacturer of said hardware.

  3. Thanks to kmount from:

    leco (7th January 2009)

  4. #3

    matt40k's Avatar
    Join Date
    Jun 2008
    Location
    Ipswich
    Posts
    4,522
    Thank Post
    374
    Thanked 675 Times in 550 Posts
    Rep Power
    166
    Few ideas:

    Check DHCP, might be trying to get an IP.
    ARP to assign it an ip.
    Check the switches (wlan) for actual location.
    Try and work out the manufacturer of the device then work from there.
    Wireshark, see if it's transmitting anything.

  5. #4
    Zimmer's Avatar
    Join Date
    Nov 2008
    Location
    Chadderton
    Posts
    116
    Thank Post
    10
    Thanked 10 Times in 10 Posts
    Rep Power
    14
    Quote Originally Posted by matt40k View Post
    Few ideas:

    Check DHCP, might be trying to get an IP.
    ARP to assign it an ip.
    Check the switches (wlan) for actual location.
    Try and work out the manufacturer of the device then work from there.
    Wireshark, see if it's transmitting anything.
    I agree with Matt, checking ARP table records is a good one, and DHCP lease history is a good one too - Failing that Wiresharking will probably help you find out a fair bit of info about the device.

    Also try Telnet, HTTP(s), FTP, SNMP trapping, SSHing to the device?

  6. #5

    FN-GM's Avatar
    Join Date
    Jun 2007
    Location
    UK
    Posts
    16,373
    Thank Post
    906
    Thanked 1,811 Times in 1,559 Posts
    Blog Entries
    12
    Rep Power
    468
    Quote Originally Posted by kmount View Post
    Without wishing to appear pedantic, try googling the first bit of the MAC as it may well reveal the manufacturer of said hardware.
    I have seen a website that when you type the mac address in it will reveal the manufctorer of the device

  7. #6
    Zimmer's Avatar
    Join Date
    Nov 2008
    Location
    Chadderton
    Posts
    116
    Thank Post
    10
    Thanked 10 Times in 10 Posts
    Rep Power
    14
    Quote Originally Posted by FN-GM View Post
    I have seen a website that when you type the mac address in it will reveal the manufctorer of the device
    Is this the one.... Vendor/Ethernet/Bluetooth MAC Address Lookup and Search

  8. Thanks to Zimmer from:

    leco (7th January 2009)

  9. #7

    FN-GM's Avatar
    Join Date
    Jun 2007
    Location
    UK
    Posts
    16,373
    Thank Post
    906
    Thanked 1,811 Times in 1,559 Posts
    Blog Entries
    12
    Rep Power
    468
    Thats the one

  10. #8


    tom_newton's Avatar
    Join Date
    Sep 2006
    Location
    Leeds
    Posts
    4,507
    Thank Post
    871
    Thanked 862 Times in 681 Posts
    Rep Power
    199
    Some switches will list their arp table - and tell you which port the device is on. Start at the core switch and wait til that MAC is the only one on a port.

  11. #9

    matt40k's Avatar
    Join Date
    Jun 2008
    Location
    Ipswich
    Posts
    4,522
    Thank Post
    374
    Thanked 675 Times in 550 Posts
    Rep Power
    166
    Is prob someone's laptop\router with a static IP if nothings in the DHCP logs.

  12. #10
    leco's Avatar
    Join Date
    Nov 2006
    Location
    West Yorkshire
    Posts
    2,026
    Thank Post
    595
    Thanked 125 Times in 119 Posts
    Rep Power
    42
    OK I don't know what wireshark is. Where do I look for arp?
    zimmer - Thanks for the link, have used that to find the address is a netgear device. So I'm guessing it is an access point.
    tom_newton - sorry I don't understand what you are suggesting.

    I apologise if this is a set of stupid questions but I actually thought that Edugeek was the place to ask about such things. After all if I don't know what the issue is then by Googling I would not know which resolution to follow.

  13. #11

    matt40k's Avatar
    Join Date
    Jun 2008
    Location
    Ipswich
    Posts
    4,522
    Thank Post
    374
    Thanked 675 Times in 550 Posts
    Rep Power
    166
    Google wireshark, it's a program that displays current network traffic.

    As it's netgear it could be a wireless\network card, but most likely some smartarse has plugged in a wireless access point.

    As tom has pointed out your switches, if they are managed will be able to tell you which point has it plugged in. If you can't be arsed\don't have managed switches, you'll need to go walk around your site looking for a netgear wireless access point \ router \ or such plugged into your network.

    As you've not had any DHCP issues, you've prob got a Wireless access point with a static ip on a different address (ie 192.168.1.x when your network is 10.0.0.x).

    I believe there is a netgear search tool. Not sure tho.

  14. Thanks to matt40k from:

    leco (7th January 2009)

  15. #12
    leco's Avatar
    Join Date
    Nov 2006
    Location
    West Yorkshire
    Posts
    2,026
    Thank Post
    595
    Thanked 125 Times in 119 Posts
    Rep Power
    42
    Quote Originally Posted by matt40k View Post
    Google wireshark, it's a program that displays current network traffic.
    Thanks for this, I'll have a look for it.

    As it's netgear it could be a wireless\network card, but most likely some smartarse has plugged in a wireless access point.

    As tom has pointed out your switches, if they are managed will be able to tell you which point has it plugged in. If you can't be arsed\don't have managed switches, you'll need to go walk around your site looking for a netgear wireless access point \ router \ or such plugged into your network.
    Only one of the switches is managed I believe. I've never really had cause to look at it. I obviously have work to do on that score, thanks. The router is a Cisco that's why I thought access point.

    As you've not had any DHCP issues, you've prob got a Wireless access point with a static ip on a different address (ie 192.168.1.x when your network is 10.0.0.x).

    I believe there is a netgear search tool. Not sure tho.
    Since the network monitor is only looking for a 10. range this seems possible. Thanks again I'll have a look for a Netgear tool.



SHARE:
+ Post New Thread

Similar Threads

  1. Disable Network Device
    By FN-GM in forum Scripts
    Replies: 2
    Last Post: 10th December 2008, 01:57 PM
  2. Unknown RAM usage.
    By Trenton_Lister in forum Windows Vista
    Replies: 7
    Last Post: 30th September 2008, 03:28 PM
  3. Small cheap network device with basic webserver?
    By pete in forum Wireless Networks
    Replies: 1
    Last Post: 13th June 2008, 10:08 AM
  4. Unknown Messages
    By dryhammer in forum Thin Client and Virtual Machines
    Replies: 2
    Last Post: 7th May 2008, 09:42 AM
  5. unknown model!?
    By browolf in forum Hardware
    Replies: 5
    Last Post: 4th April 2008, 02:56 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •