Tracking down a user

[Sonic007]

Hi all,

 

So we arer a small primary school and our netsweeper report showed a machine where someone has been accessing porn and vaping sites.

 

So I have the IP of the machine involved and put it into Advanced IP Scanner and it's shown me a machine name with that IP address.

 

I can't seem to find that machine anywhere and it could be anywhere over the school. It is not in a small VLAN which would make it easier to find.

 

I have the MAC address associated with the IP when I looked it up.

 

Netsweeper's Internet logs for that IP seems to point to a lot of icloud and apple servers so I'm thinking possibly a Mac.

 

AdvanceIP Scanner has given it a name as in jun-lt-hall which would indicate a laptop in the hall but I cant find a laptop with that name at the moment.

Anything else I could do to try and find it?

 

 

Thankyou.

Edited January 12, 2024 by Sonic007

[Jawloms]

If you have the MAC address you could do a vendor lookup and see the manufacturer of the NIC. Might give some clues?

 

Block the MAC in your DHCP server, then see who appears at your office door complaining their laptop doesn't seem to be connecting?

[simpsonj]

Depending on how small your school is, you could install Lansweeper (or similar)

 

https://www.lansweeper.com/

 

Free for 100 assets or less, even if you just used it to scan your switches, it might find the laptop attached to a port.

[Sonic007]

Good idea blocking the Mac address.

 

Did a vendor look up on the MAC address and it is an Apple device.

 

Can Advanced IP scanner get confused and have given it the wrong name? As I do not have any Macs as a hall laptop.

Thankyou.

Edited January 12, 2024 by Sonic007

[Davit2005]

Search WiFi and Switches for the MAC address.

[APMerry]

Assuming it's connected to your wifi right now, you should be able to see what access point they're connected to. Will give you a rough idea where they are.

[Sonic007]

That's great. Thankyou. I've now seen it's connected to our EAST Wifi access point so starting to narrow it down and look at Apple devices in that area.

[CHiLL]

If you can get a hostname from the MAC address from the switches or APs, that might be more reliable to identify a newer mobile device. In later versions of iOS and Android, private MAC addresses are on by default, which generate random MAC addresses and doesn't use the actual physical MAC of the device and it would make it difficult to find such a device with a private MAC.

[sigma]

Do you know “know” it’s a device in your school?

 

Since New Year, I have had a device that’s not from our school showing up in our Netsweeper reports. It’s been trying to access web proxies through all of our transparent (non client) proxies. Now blocked in Netsweeper by IP Addy. You could try that and see who shouts?

 

 

We are on SBB’s Netsweeper. They are not bothered about it.

[Sonic007]

Thankyou everyone,

 

 

 

It's a device that is connected to the wifi so would have needed to have had the password added at some point.

So I can see the IP address showing up in Adavanced IP scanner as active and confirmed that by blocking it in UnifiOS. So I have the IP and Mac address.

As has been pointed out, it doesnt help that all our iPads have Private Mac address switched on so that might put a problem into the mix.

 

I'm going to keep an eye on it and see if I can find out anymore.