kevin_lane Posted March 21, 2014 Posted March 21, 2014 trying find the location of an ip address that is connected to a switch any good quick tools as for some reason its mostly the cause of my network issue this morning
psydii Posted March 21, 2014 Posted March 21, 2014 ARP to get the mac Query the mac table on the switch to get the port. 2
kevin_lane Posted March 21, 2014 Author Posted March 21, 2014 10.25.15.255 ff-ff-ff-ff-ff-ff this is strange because our dhcp scope only goes upto 10.25.14.254 and we have nothing that is going to be broadcasting that address
mac_shinobi Posted March 21, 2014 Posted March 21, 2014 That's the broadcast address.. Not a device. Just to confirm - how do you use the ARP command to establish the mac address of the device etc ?
psydii Posted March 21, 2014 Posted March 21, 2014 If it is causing show stopping issues... Unplug half the ports and see if thee problem goes away. If it remains, unplug half Again. If it has gone... Reconnect half the cables, rinse and repeat until you isolate the port connected to te device sending the broadcasts.
siuko Posted March 21, 2014 Posted March 21, 2014 If I understand you right... I think Lantopolog should work
kevin_lane Posted March 21, 2014 Author Posted March 21, 2014 don't really want have to start unplugging
psydii Posted March 21, 2014 Posted March 21, 2014 From a device in the same broadcast domain, ping the offending IP, then Arp -c to get a list of mac:ip 1
psydii Posted March 21, 2014 Posted March 21, 2014 don't really want have to start unplugging It is the fastest way. And if the network is dead or close to dead in the water, it is also the best way. 1
psydii Posted March 21, 2014 Posted March 21, 2014 Just occurred to me, if you are confident at a switch command line, you could just shut the ports down... Which would be quicker and tidier, and do-able remotely. (Didn't have the luxury of that feature last time I had to use this technique!)
Mark182 Posted March 21, 2014 Posted March 21, 2014 If I understand this right you could nbtstat –a the IP address find the name of device? Or try show interface brief on the router?
kevin_lane Posted March 21, 2014 Author Posted March 21, 2014 yea I tried the nbtstat but wouldn't show anything
kevin_lane Posted March 21, 2014 Author Posted March 21, 2014 ok just checked in dns under reverse lookup zone and there is a zone 15.25.10-in-addr.arpa ??? with all of my 3 DCs in how is that even poss
mikeyd101 Posted March 21, 2014 Posted March 21, 2014 nmap and / or wireshark (or windows network monitor) nmap will let you probe an ip address wireshark (wnm) will let you trace traffic and see what the source of the traffic is As mentioned something is broadcasting I'd try wireshark first and see what you can get from a trace, Only thing I can think off the top of my head is that either you have a little hacker or some net service causing a broadcast storm.
mikeyd101 Posted March 21, 2014 Posted March 21, 2014 Broadcast address is defined by netmask, what netmask are you using? 255.255.252.0 (22) that gives you broadcast of 10.25.15.255 IP Calculator / IP Subnetting
mikeyd101 Posted March 21, 2014 Posted March 21, 2014 (edited) arp -a or just arp -a to get a table of mac/ips or just arp will give command line options I think that the device has to be on the same subnet/vlan to get its mac address back tho. Edited March 21, 2014 by mikeyd101
kevin_lane Posted March 21, 2014 Author Posted March 21, 2014 well I have managed to get the mac address 10.25.15.255 mac address 1C:C1:DE:58:6A:55 and the manufacturer is HP
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now