Discover IP address of flea-market print spooler

I picked up a flea-market hardware print spooler, but need to find out
it's IP address before I can get any further. The documentation is
heavily oriented toward their proprietary software, but there is a web
server in there, and if I can just connect, I can start from there.
The lights all light in the correct ways, and the price was right, but
there is no hardware reset button. I need to get in, in order to do
anything.

Is there a fast/simple way to discover the IP address of an unknown
appliance, given the knowledge that it DOES have one?

Operating on the chance that it's on 192.168.0.0/16, I've got it hooked
to one system, set to 192.168.0.1/16, by a crossover cable. A broadcast
ping got no response, which is not necessarily surprising. At the
moment, I've got Nessus running the whole 192.168.0.0/16. I've scanned
the range piecemeal once, finding nothing, but it's possible that I'm
missing an address right on the boundary.

Before moving on to 172.16.0.0/12 and 10.0.0.0/8, is there a faster way
to discover this, assuming the broadcast ping doesn't work? It would
seem that there should be some way to do this, or at least verify that
the box is alive at the ARP level, but the man page doesn't offer me
anything. Am I missing something, here?

Thanks,
Dale Pontius


Dale Pontius

Dale Pontius <(E-Mail Removed)> wrote:
> I picked up a flea-market hardware print spooler, but need to find out
> it's IP address before I can get any further. The documentation is
> heavily oriented toward their proprietary software, but there is a web
> server in there, and if I can just connect, I can start from there.
> The lights all light in the correct ways, and the price was right, but
> there is no hardware reset button. I need to get in, in order to do
> anything.
>
> Is there a fast/simple way to discover the IP address of an unknown
> appliance, given the knowledge that it DOES have one?

Sadly, there is no reliable fast way of doing this. I found myself in
your exact same situation with a Dick Smith (rebadged) no-name parallel
port-ethernet print controller that came with a Windows setup program.
(I gave in and just used the windows program to configure it with an
initial address)

My device didn't ship with DHCP enabled (which to my mind is silly, but
seeing as its a consumer device, understandable, as most consumers don't
have the ability to assign static addresses via DHCP).

There are three IP ranges I would scan for. First, make sure your
default route is set to the network in question so all packets will go
out the correct interface. Also check that you don't have any firewall
enabled on your computer.

The ranges are as follows.

192.168.{0,1,254}.0/24 (this is three ranges)
169.254.0.0/16 (this is the zero-conf range, also used for
unconfigured devices)
192.168.0.0/24
172.16.0.0/12
10.0.0.0/8
224.0.0.0/8 (link-local multicast, there is a chance unconfigured
devices may listen to particular multicast addresses)
Scanning this one may be rather difficult, as they're unlikely
to respond to pings, and ICMP port unreachables won't be sent
for UDP on multicast, IIRC.

OK, so its considerably more than three, but these are the ranges I
would scan in order. If you're doing this with nmap, I would suggest you
change the timing to be Aggressive.

And if you do end up falling back to the Windows applet, you might try
sniffing the network to see what its doing.

The reason why there is no easy, fast way to find this is because it
makes it easier for (other) people to map/scan networks.

And of course, sniffing the network as you power on the device may
occasionally be enlightening. Esp if the device has something like
Appletalk enabled (it will send advertisements)

--
Cameron Kerr
(E-Mail Removed) : http://nzgeeks.org/cameron/
Empowered by Perl!

> I picked up a flea-market hardware print spooler, but need to find out
> it's IP address before I can get any further. The documentation is
> heavily oriented toward their proprietary software, but there is a web
> server in there, and if I can just connect, I can start from there.
> The lights all light in the correct ways, and the price was right, but
> there is no hardware reset button. I need to get in, in order to do
> anything.
>
> Is there a fast/simple way to discover the IP address of an unknown
> appliance, given the knowledge that it DOES have one?

I assume it's on ethernet, in which case the method used to associate an IP
address with a MAC (hardware) address is ARP, Address Resolution Protocol.

The first thing I would try is running "tcpdump arp" on your Linux host,
and then connect and power up your mysterious hardware. Perhaps it will
send out some ARP packets or something. Also, keep sniffing for ARP packets
while you do things like broadcast pings or scans.

--
Jem Berkes
http://www.sysdesign.ca/

Dale Dellutri <(E-Mail Removed)> wrote:

> Is the MAC address printed on the device? If it is, then you could
> set the address instead of trying to discover it:
> arp -s <ip address in dotted quads> xx:xx:xx:xx:xx:xx
> would set it to the IP address you wanted.

This ought not to work, as the device shouldn't pass the packet up past
the datalink layer. Although, I guess with some embedded devices, they
aren't as strict about following (even basic) rules, in order to make
the device as small as possible.

--
Cameron Kerr
(E-Mail Removed) : http://nzgeeks.org/cameron/
Empowered by Perl!

On Sun, 23 May 2004 21:08:33 -0400, Dale Pontius <(E-Mail Removed)> wrote:
> I picked up a flea-market hardware print spooler, but need to find out
> it's IP address before I can get any further. The documentation is
> heavily oriented toward their proprietary software, but there is a web
> server in there, and if I can just connect, I can start from there.
> The lights all light in the correct ways, and the price was right, but
> there is no hardware reset button. I need to get in, in order to do
> anything.

> Is there a fast/simple way to discover the IP address of an unknown
> appliance, given the knowledge that it DOES have one?

>...

Is the MAC address printed on the device? If it is, then you could
set the address instead of trying to discover it:
arp -s <ip address in dotted quads> xx:xx:xx:xx:xx:xx
would set it to the IP address you wanted. I did this with an
internal print server that I bought on ebay for an Epson printer.

(From one Dale to another.)

--
Dale Dellutri <(E-Mail Removed)> (lose the Q's)

On Sun, 23 May 2004 21:08:33 -0400, Dale Pontius <(E-Mail Removed)> wrote:
> I picked up a flea-market hardware print spooler, but need to find out
> it's IP address before I can get any further. The documentation is
> heavily oriented toward their proprietary software, but there is a web
> server in there, and if I can just connect, I can start from there.
> The lights all light in the correct ways, and the price was right, but
> there is no hardware reset button. I need to get in, in order to do
> anything.

> Is there a fast/simple way to discover the IP address of an unknown
> appliance, given the knowledge that it DOES have one?

In a previous followup, I forgot to mention that the default IP
address of my internal print server for the Epson was 11.22.33.44. So
other posters' suggestions to search the "known" private IP spaces
wouldn't work in my case. That's why I suggested setting it instead
of trying to discover it. The documentation on the Epson site for a
similar print server (but not the same model number) said to set it
via the arp command.

--
Dale Dellutri <(E-Mail Removed)> (lose the Q's)

(E-Mail Removed)lid (Dale Pontius) wrote in message news:<(E-Mail Removed)>...
> I picked up a flea-market hardware print spooler, but need to find out
> it's IP address before I can get any further. The documentation is
> heavily oriented toward their proprietary software, but there is a web
> server in there, and if I can just connect, I can start from there.
> The lights all light in the correct ways, and the price was right, but
> there is no hardware reset button. I need to get in, in order to do
> anything.
>
> Is there a fast/simple way to discover the IP address of an unknown
> appliance, given the knowledge that it DOES have one?

If you're really lucky there will be a way to set it back to "factory
default" mode. Then you can just check the manual (online or otherwise
for what the default setting are.

On 24 May 2004, Cameron Kerr <(E-Mail Removed)> wrote:
> Dale Dellutri <(E-Mail Removed)> wrote:
>
>> Is the MAC address printed on the device? If it is, then you could
>> set the address instead of trying to discover it:
>> arp -s <ip address in dotted quads> xx:xx:xx:xx:xx:xx
>> would set it to the IP address you wanted.
>
> This ought not to work, as the device shouldn't pass the packet up past
> the datalink layer. Although, I guess with some embedded devices, they
> aren't as strict about following (even basic) rules, in order to make
> the device as small as possible.

Actually it usually should work for most print servers locally which
communicate on MAC level. But it would be nice if the device had a test
button, so it could be connected to a printer and print out its current
config. That helped me determine that what was thought to be a dead
JetDirect, just had numbers transposed in mistyped 192.186... static IP
(should have been 192.168...). Although, all I really needed was reset,
so it would use default DHCP (then reprint config to find it).

--
David Efflandt - All spam ignored http://www.de-srv.com/

David Efflandt <(E-Mail Removed)> wrote:
>> Dale Dellutri <(E-Mail Removed)> wrote:
>>
>>> Is the MAC address printed on the device? If it is, then you could
>>> set the address instead of trying to discover it:
>>> arp -s <ip address in dotted quads> xx:xx:xx:xx:xx:xx

> Actually it usually should work for most print servers locally which
> communicate on MAC level.

How??? If I send a ethernet frame to MAC_A, when that station is set
with MAC_B, why on earth would it accept it and pass it up the network
stack?

--
Cameron Kerr
(E-Mail Removed) : http://nzgeeks.org/cameron/
Empowered by Perl!

Dale Dellutri <(E-Mail Removed)> wrote:

> The documentation on the Epson site for a similar print server (but
> not the same model number) said to set it via the arp command.

Ah, that explains that particular odity then.

--
Cameron Kerr
(E-Mail Removed) : http://nzgeeks.org/cameron/
Empowered by Perl!