Identify a network device

[edie209]

A device has taken an IP address on the network and I am trying to identify it but how?

 

I have tried

 

ipconfig -a xxx.xxx.xxx.xxx and I get a reply but no name

 

getmac /S xxx.xxx.xxx.xxx and I get Error:the RPC server is unavailable

 

nbtstat -a xxx.xxx.xxx.xxx and I get host not found

 

I have tried SolarWinds IPaddress Tracker which can see the device but does not report what it is

 

The Dude also can see the device but just reports it as some device

 

I a now looking for another idea to identify this device

[pete]

If you've managed switches, interrogate them to see where it's connected. You should be able to pull a MAC <> Port list. If it's a wireless device look at the APs it's associating (or attempting to associate) with for an idea of physical location.

 

Search for the MAC address here: IEEE-SA - Registration Authority OUI Public Listing as well, for an idea of who makes the network interface.

 

And get a copy of nmap (nmap.org) and use something like:

 

nmap -A IP.AD.DRE.ESS

 

to get more of an idea about the type of device. Guide here: Nmap Network Scanning - basic usage is available in the usual way (manpages or nmap /? on windows).

 

On a mobile device, Fing (free on Google Play and iirc Apple's App Store) does a reasonably decent job of guessing mac vendors.

[plexer]

Weird that's exactly what I was doing yesterday whilst tracking what was connected to ports on a switch I looked up the mac table for the particular switch port and then looked up the coportations who have those mac address prefixes allocated to them

 

Ben

[Gibson335]

A telnet might give you a clue in its reply?

[Danp]

If I spot something I cant identify then it gets added to the deny list and deleted. If genuine, they will soon be in touch.

[edie209]

If you've managed switches, interrogate them to see where it's connected. You should be able to pull a MAC <> Port list. If it's a wireless device look at the APs it's associating (or attempting to associate) with for an idea of physical location.

 

Search for the MAC address here: IEEE-SA - Registration Authority OUI Public Listing as well, for an idea of who makes the network interface.

 

And get a copy of nmap (nmap.org) and use something like:

 

nmap -A IP.AD.DRE.ESS

 

to get more of an idea about the type of device. Guide here: Nmap Network Scanning - basic usage is available in the usual way (manpages or nmap /? on windows).

 

On a mobile device, Fing (free on Google Play and iirc Apple's App Store) does a reasonably decent job of guessing mac vendors.

 

 

I have now managed to identify it as an Intel device (great) I can't telnet into it, I have also tried Putty with no luck

 

What tool are you using to interrogate your switches? I have just found one called Managed Switch Port Mapping Tool Download Switch Port Mapper 30 Day Trial Software but its very slow

[mac_shinobi]

Used LANView http://archive.org/details/tucows_271684_LANView

 

Seemed to work well, then was just a case of walking around and finding the pc or device and disconnecting it

 

If its a students laptop etc then as above deny it or reserve a dhcp ip address thats not on your ip range ??

Edited June 18, 2013 by mac_shinobi

[edie209]

see this is where it gets very strange the said IP is not in a DHCP range and only came to my attention yesterday when I was dealing with an issue with a server.

[mac_shinobi]

see this is where it gets very strange the said IP is not in a DHCP range and only came to my attention yesterday when I was dealing with an issue with a server.

 

Seems jxdev don't exist anymore and may have to download a trial demo version of LAN View ( although it had a few columns which allowed me to cross reference the mac address with the hostname of the device etc )

 

What about angry ip scanner ? Think you can do the same on this - although come to think of it you mentioned that its not on the same ip range as your dhcp scope ?

 

the nmap suggestion above is a good one so will just stay subscribed and keep an eye on this thread

Edited June 18, 2013 by mac_shinobi

[glen_j]

have you tried putting the ipaddress into a web browser to see if you can connect to it?

[pete]

I have now managed to identify it as an Intel device (great) I can't telnet into it, I have also tried Putty with no luck

 

What tool are you using to interrogate your switches? I have just found one called Managed Switch Port Mapping Tool Download Switch Port Mapper 30 Day Trial Software but its very slow

 

I ssh into the backbone switch (Procurve in the below example) and use:

 

show mac-address MACADDRESSIMLOOKINGFOR

 

Say it appears on port E2

 

show name E2

 

Which (because I've labelled all the ports on the backbone switch) will tell me it's the English Block.

 

If you haven't diligently labelled your ports, using

 

show lldp info remote-device E2

 

Should at least give you the hostname and IP address (if it's a switch/router/ap/whatever).

 

Then I shell into the English block switch and query the mac address as I did on the backbone.

 

There are more elegant ways of doing it - say the mactrack plugin for Cacti (Disclaimer: I've eyed this up, but never actually used it) should I wish to spend the time setting it up, but it's an infrequent need for me.

[edie209]

have you tried putting the ipaddress into a web browser to see if you can connect to it?

 

Yes it just refuses connection

[plexer]

If you can track the mac address down to a specific switch port and it looks like it's the actual device connected or the actual device connected is a wireless access point then you can identify which physical wall port is connected to that switch port and go find it?

 

Ben

[mikeyd101]

How about something like wireshark on a machine upstream filtered by the ip address. You might be able to find out what / if any traffic is being generated.

[mac_shinobi]

How about something like wireshark on a machine upstream filtered by the ip address. You might be able to find out what / if any traffic is being generated.

@mikeyd101 - not done this before , any chance of some brief step by step instructions on how you would do this on or in wireshark ?

 

Ta

[mikeyd101]

its been a while since i done any packet filtering stuff, get wireshark installed and running and think its fairly self explanatory installer. Start it up and hit capture and go (think this will capture everything, and good test to make sure your actually capturing something). Then there is a filter box which i believe you can use and option like:

 

ip.addr==X.X.X.X

 

to filter only traffic in/out bound to that address. Again its worth checking this first using a known IP that you can generate traffic on (i.e. your own laptop, and web browse to somewhere). I'm not sure how IP broadcast / listening works over routers, so you might have todo some more digging. I'll try and find a wireshark quickstart.

 

shows basics of using wireshark.

 

Also some network cards work better than others with wireshark, think its todo with if they can work in promiscuous mode.

 

Good luck hope you find the device.

Edited June 18, 2013 by mikeyd101

[ADMaster]

Hello,

 

You will want to setup port mirroring on the port you want to monitor. Switches only send traffic to the port it is Destin for, unless it is a broadcast. Port mirroring will send a copy of the traffic to the port you specify. This will allow wire shark to capture it.

 

Regards,

[edie209]

After using the switch port mapper that I mentioned above I have found the device. Its one of our servers, however that's only half of it although it has it own IP and MAC address it seems to have a phantom IP and MAC address. Has anyone had an issue like this before? I have proved it by doing a ping -t to the ip address and removed the network cable. but the adapter definatley has its proper IP and MAC and a phantom set?????.

 

 

On another note I have found a graphing tool to go with Wireshark that is being talked about about, WildPackets Network Forensics Utility "Compass" it can be downloaded here Compass Free - CNET Download.com

 

Edited June 19, 2013 by edie209

[pete]

After using the switch port mapper that I mentioned above I have found the device. Its one of our servers, however that's only half of it although it has it own IP and MAC address it seems to have a phantom IP and MAC address. Has anyone had an issue like this before?

 

Off the top of my head - onboard management sharing the network interface.

[mikeyd101]

is there a VM running on the machine, that could have its own ip and mac?

[cpjitservices]

Is it not ILO ?

 

I know some of our IBM's have "Phantom IP's" this is for connecting to them remotely via console, it's sop you can interact with BIOS and see it reboot etc.

[catch21]

Its not the connection to a UPS is it?