[nycbug-talk] Finding a device's IP address

[Robin Polak]

You could try running arpwatch on a machine in the vlan and identify
it that way.

On 3/19/09, Charles Sprickman <spork at bway.net> wrote:
> On Thu, 19 Mar 2009, Pete Wright wrote:
>
>> On 19-Mar-09, at 3:52 PM, Charles Sprickman wrote:
>>
>>> Perhaps a bit OT, but a general question...
>>>
>>> You have a device on a network that you do not have physical access to.
>>> It has an IP address which may or may not be on the subnet it's actually
>>> attached to.
>>>
>>> How do you find what IP is configured?  What magic ARP stuff can you spew
>>> in it's direction that would perhaps make it respond with something that
>>> would give away it's IP?
>>
>> in the past when i've been in this pickle i logged into a switch i
>> suspected
>> was close to the host in question.  found its entry in the arp cache
>> (which
>> was associated w/another switch).  connected to that switch, washed hands
>> repeated until i found the subnet that the box was on (in this case our
>> IBM
>> nodes all had a similar range of mac addy's which was sufficiently
>> different
>> than our foundry switches which made things easier).
>
> That's near where I started.  I'm thinking that perhaps the switch is a
> bit wonky, because I've looked at the "port address table" on this HP
> switch and it just comes up empty, which is annoying:
>
> ===========================- TELNET - MANAGER MODE
>                 Status and Counters - Port Address Table - Port 11
>
>     MAC Address
>    -------------
>
> Nice, huh?
>
>> there's even a fun diagram i found online:
>> http://www.networkblueprints.com/troubleshooting/using-mac-address-table-and-arp-cache-lan
>
> Thanks for the pointers...
>
> Charles
>
>> HTH
>> -p
> _______________________________________________
> talk mailing list
> talk at lists.nycbug.org
> http://lists.nycbug.org/mailman/listinfo/talk
>


-- 
Robin Polak
E-Mail: robin.polak at gmail.com
V. 917-494-2080