Rogue Device

[steve_nfi]

Does anyone know any software (preferably free) for tracking down a rogue device.

I have this device in DHCP called 'AD-Converter'. I know the IP address and the MAC address. What I want to know is what it is and where it is.

Anyone got any ideas please?

[tech_guy]

You've got an analogue to digital device on your network - you got a digital tv signage system? Or to do with your CCTV?

[chinesewhispers]

Do you have managed switches that you can trace MAC addresses by port connection?

[steve_nfi]

You've got an analogue to digital device on your network - you got a digital tv signage system? Or to do with your CCTV?

 

Come to thiink of it our Premises Manager had some work done to the CCTV system a couple of monnths ago. I'll have to check with him. This thing, whatever it is, is taking about 2/3 of our incoming bandwidth.

[steve_nfi]

Do you have managed switches that you can trace MAC addresses by port connection?

 

Unfortunately not.

[mjs_mjs]

Unfortunately not.

 

you should look into investing in layer 3 switching - the linksys 2024 are a good managed gigabit switch.

[steve_nfi]

We are just in the process of getting quotes in to have most of our switches replaced. They are fairly old now and although managed to a certain degree, they can't do what you seem to be able to do on modern switches.

[mac_shinobi]

Not sure about free but you should be able to use LAN View on its trial period to find the device

 

LANView is a powerful tool for LAN administration

 

That or wire shark ?

[steve_nfi]

I have lanview running on our system and this thing doesn't show up.

It's still got the same IP and you can ping, I just can't find what and where it physically is.

 

Refering to an earlier post about the CCTV. Apparently the CCTV is all hard wired and doesn't touch the network. Back to square one.

[mac_shinobi]

I have lanview running on our system and this thing doesn't show up.

It's still got the same IP and you can ping, I just can't find what and where it physically is.

 

Refering to an earlier post about the CCTV. Apparently the CCTV is all hard wired and doesn't touch the network. Back to square one.

 

Tools --> Lookup host

 

Enter in the IP Address and search and it should show up the hostname which may or may not make it easier ?

 

If not as above wire shark

 

http://www.wireshark.org/

 

Others on here may have more experience of using wire shark which I don't

Edited October 16, 2009 by mac_shinobi

[keithu]

If you don't have managed switches you'll just have to search using a 'divide and conquer' approach. Set up a continuous ping to your mystery device and then, starting at the middle of your network, disconnect a branch for a moment. If you lose a ping you know the device is on that branch. Do the same thing further down that branch, and repeat until you're down to a single port. It sounds like a long job but it doesn't take too long.

[steve_nfi]

Heres a network monitoring free package

 

MikroTik Routers and Wireless

 

Seems pretty good. Just trying to decypher it. Probably easy to the more technically adept.

[steve_nfi]

Tools --> Lookup host

 

Enter in the IP Address and search and it should show up the hostname which may or may not make it easier ?

 

 

I don't appear to have a tools option on mine. I have a client tools radio button but there isn't a Lookup host option on that. I'm running Lanview v3.1.9.

[budgester]

How do you do your routing to the internet ?

 

Has this device picked up a IP address from your DHCP server ?

 

Could you assign a fixed lease to the device, and then route/block any traffic from the devices ip address ?

 

Then when it breaks it someone will come and find you.