leco Posted January 7, 2009 Posted January 7, 2009 Is there a way of searching the network looking for a mac address? My network monitor is displaying a device, which it says has no IP address but does have a mac address. I didn't think that devices could be on a network without an IP so that shows how much I know.
kmount Posted January 7, 2009 Posted January 7, 2009 Without wishing to appear pedantic, try googling the first bit of the MAC as it may well reveal the manufacturer of said hardware. 1
matt40k Posted January 7, 2009 Posted January 7, 2009 Few ideas: Check DHCP, might be trying to get an IP. ARP to assign it an ip. Check the switches (wlan) for actual location. Try and work out the manufacturer of the device then work from there. Wireshark, see if it's transmitting anything.
Zimmer Posted January 7, 2009 Posted January 7, 2009 Few ideas: Check DHCP, might be trying to get an IP. ARP to assign it an ip. Check the switches (wlan) for actual location. Try and work out the manufacturer of the device then work from there. Wireshark, see if it's transmitting anything. I agree with Matt, checking ARP table records is a good one, and DHCP lease history is a good one too - Failing that Wiresharking will probably help you find out a fair bit of info about the device. Also try Telnet, HTTP(s), FTP, SNMP trapping, SSHing to the device?
FN-GM Posted January 7, 2009 Posted January 7, 2009 Without wishing to appear pedantic, try googling the first bit of the MAC as it may well reveal the manufacturer of said hardware. I have seen a website that when you type the mac address in it will reveal the manufctorer of the device
Zimmer Posted January 7, 2009 Posted January 7, 2009 I have seen a website that when you type the mac address in it will reveal the manufctorer of the device Is this the one.... Vendor/Ethernet/Bluetooth MAC Address Lookup and Search 1
tom_newton Posted January 7, 2009 Posted January 7, 2009 Some switches will list their arp table - and tell you which port the device is on. Start at the core switch and wait til that MAC is the only one on a port.
matt40k Posted January 7, 2009 Posted January 7, 2009 Is prob someone's laptop\router with a static IP if nothings in the DHCP logs.
leco Posted January 7, 2009 Author Posted January 7, 2009 OK I don't know what wireshark is. Where do I look for arp? zimmer - Thanks for the link, have used that to find the address is a netgear device. So I'm guessing it is an access point. tom_newton - sorry I don't understand what you are suggesting. I apologise if this is a set of stupid questions but I actually thought that Edugeek was the place to ask about such things. After all if I don't know what the issue is then by Googling I would not know which resolution to follow.
matt40k Posted January 7, 2009 Posted January 7, 2009 Google wireshark, it's a program that displays current network traffic. As it's netgear it could be a wireless\network card, but most likely some smartarse has plugged in a wireless access point. As tom has pointed out your switches, if they are managed will be able to tell you which point has it plugged in. If you can't be arsed\don't have managed switches, you'll need to go walk around your site looking for a netgear wireless access point \ router \ or such plugged into your network. As you've not had any DHCP issues, you've prob got a Wireless access point with a static ip on a different address (ie 192.168.1.x when your network is 10.0.0.x). I believe there is a netgear search tool. Not sure tho. 1
leco Posted January 7, 2009 Author Posted January 7, 2009 Google wireshark, it's a program that displays current network traffic. Thanks for this, I'll have a look for it. As it's netgear it could be a wireless\network card, but most likely some smartarse has plugged in a wireless access point. As tom has pointed out your switches, if they are managed will be able to tell you which point has it plugged in. If you can't be arsed\don't have managed switches, you'll need to go walk around your site looking for a netgear wireless access point \ router \ or such plugged into your network. Only one of the switches is managed I believe. I've never really had cause to look at it. I obviously have work to do on that score, thanks. The router is a Cisco that's why I thought access point. As you've not had any DHCP issues, you've prob got a Wireless access point with a static ip on a different address (ie 192.168.1.x when your network is 10.0.0.x). I believe there is a netgear search tool. Not sure tho. Since the network monitor is only looking for a 10. range this seems possible. Thanks again I'll have a look for a Netgear tool.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now