Wired Networks Thread, Identify a network device in Technical; Originally Posted by mikeyd101
How about something like wireshark on a machine upstream filtered by the ip address. You might ...
18th June 2013, 04:51 PM #16
@mikeyd101 - not done this before , any chance of some brief step by step instructions on how you would do this on or in wireshark ?
Originally Posted by mikeyd101
18th June 2013, 05:24 PM #17
- Rep Power
its been a while since i done any packet filtering stuff, get wireshark installed and running and think its fairly self explanatory installer. Start it up and hit capture and go (think this will capture everything, and good test to make sure your actually capturing something). Then there is a filter box which i believe you can use and option like:
to filter only traffic in/out bound to that address. Again its worth checking this first using a known IP that you can generate traffic on (i.e. your own laptop, and web browse to somewhere). I'm not sure how IP broadcast / listening works over routers, so you might have todo some more digging. I'll try and find a wireshark quickstart.
shows basics of using wireshark.
Also some network cards work better than others with wireshark, think its todo with if they can work in promiscuous mode.
Good luck hope you find the device.
Last edited by mikeyd101; 18th June 2013 at 05:34 PM.
Thanks to mikeyd101 from:
mac_shinobi (18th June 2013)
18th June 2013, 11:08 PM #18
You will want to setup port mirroring on the port you want to monitor. Switches only send traffic to the port it is Destin for, unless it is a broadcast. Port mirroring will send a copy of the traffic to the port you specify. This will allow wire shark to capture it.
19th June 2013, 01:08 PM #19
After using the switch port mapper that I mentioned above I have found the device. Its one of our servers, however that's only half of it although it has it own IP and MAC address it seems to have a phantom IP and MAC address. Has anyone had an issue like this before? I have proved it by doing a ping -t to the ip address and removed the network cable. but the adapter definatley has its proper IP and MAC and a phantom set?????.
On another note I have found a graphing tool to go with Wireshark that is being talked about about, WildPackets Network Forensics Utility "Compass" it can be downloaded here Compass Free - CNET Download.com
Last edited by edie209; 19th June 2013 at 01:11 PM.
19th June 2013, 03:19 PM #20
Off the top of my head - onboard management sharing the network interface.
Originally Posted by edie209
20th June 2013, 05:50 PM #21
- Rep Power
is there a VM running on the machine, that could have its own ip and mac?
3rd July 2013, 09:13 AM #22
Is it not ILO ?
I know some of our IBM's have "Phantom IP's" this is for connecting to them remotely via console, it's sop you can interact with BIOS and see it reboot etc.
3rd July 2013, 05:13 PM #23
- Rep Power
Its not the connection to a UPS is it?
By Ben-BSH in forum Wireless Networks
Last Post: 4th November 2009, 02:53 PM
By leco in forum How do you do....it?
Last Post: 7th January 2009, 08:04 PM
By FN-GM in forum Scripts
Last Post: 10th December 2008, 12:57 PM
By DaveP in forum Hardware
Last Post: 2nd September 2008, 08:18 PM
By pete in forum Wireless Networks
Last Post: 13th June 2008, 09:08 AM
Users Browsing this Thread
There are currently 1 users browsing this thread. (0 members and 1 guests)