(E-Mail Removed) wrote:
> Hi,
>
> I have around 2-3 IPs on valid IP range which is a reserved pool of IP
> given to us by our ISP. These IPs are live and pinging. We are sure
> that we have not allocated any box with such IP address.
>
> How can I find out which is that box which is using these IP? These IP
> are live within the network because when we do a traceroute from
> outside, it comes back within our network.
>
> What is the way out? Is there any s/w available or do we have to do the
> hard way of unplugging cables and finding out?
>
> Thanks in advance
>
> bandas
>
A few thoughts to get things started:
It probably depends somewhat on how big a LAN you're dealing with, what
you use for switching, and whether the rogue machines are deliberately
trying to hide or not (e.g. by spoofing).
With dumb switches, the simplest way might be to pick a quiet time and
start pinging the address of a rogue, then follow the blinking status
lights through your switch fabric. If you have wireless links, that
might not be possible.
Check any DHCP servers on your network to determine whether they've
made the allocation. And if you're doing DNS locally, that can be
queried, too.
arp might give a little additional information (e.g. manufacturer of
the interface or equipment involved).
Of course, you could also broadcast a request to your users and ask
them whether they've captured the addresses in question.
--
The e-mail address in our reply-to line is reversed in an attempt to
minimize spam. Our true address is of the form che...@prodigy.net.
Similar Threads
Linear Mode
