IP address conflict

[bodminman]

Hi there,

 

This morning we have had an up conflict with a device that as a reservation.

 

I have the MAC address of the device that has the same up as the domain device but I cannot find any other info about it.

 

I have looked through our web filter logs and server logs for any further info in the offending MAC address but there is literally nothing to be found.

 

To get around this I have had to change the IP of the reserved device but am stumped at how to find the naughty item.

 

Anyone got any ideas?

 

Thanks

[PyROm]

The first 3 segments of a MAC address specify the vendor. Google just the first 3 sections eg. 00:00:00 might narrow down the make/device type you are looking for.

[JJonas]

Does this help?

 

https://community.spiceworks.com/topic/18331-locating-a-device-by-its-ip-address

[Jawloms]

Now that you've given the known device a different IP, can you do a ping -a to resolve to a name?

[Davit2005]

Ping the naughty device from another laptop/desktop on the same logical network (vlan), open a cmd prompt on the laptop/desktop and do enter arp -a find the MAC address in the list next to the IP address and then trace the MAC address through the network, locate the switch port and then locate the wall port location. If you have cli access to the switches it should make it a bit quicker as you do not need to use the GUI on multiple switches.

 

I've done this many times before when we have needed to find a Router that someone has plugged into the network unknowingly giving out wrong IP addresses effecting service.

Edited October 16, 2019 by Davit2005

[TechMonkey]

I'd use MacVendors to find the manufacturer. Might not help but may narrow it down. Then use your Switches to see if you can pinpoint what area it is in. You may be lucky and even narrow it down to a port. Depends on what switches you have but if they are HP here is our quick documentation:

 

Trace a device by MAC

In the CLI for the core switch enter

• show mac-address xxxxxxxxxxxx

This will show which port a device has come into the switch from.

Note port info

Enter

• show lldp info remote

This will show all ports and the info (if available) of the device at the end.

Match port reported

If showing another switch repeat process on that switch

If no info that port is probably the end device connection. Trace port to patch.

[bodminman]

The first 3 segments of a MAC address specify the vendor. Google just the first 3 sections eg. 00:00:00 might narrow down the make/device type you are looking for.

 

Thanks for this. It was one of the first things i tried and it gave me this: Sagemcom Broadband SAS

 

Have just been through our boarding houses and haven't found any device like it.

 

I will be constantly checking for the IP tonoght to see if the device comes alive.

 

Thanks

[bodminman]

Does this help?

 

https://community.spiceworks.com/topic/18331-locating-a-device-by-its-ip-address

 

I'm afraid not. I done a port scan on the IP and nothing is found. Pinging just comes back with Destination host unreachable.

 

I shall leave the ping going until something appears.

 

Thanks anyway