Need help locating a ip on my network

[Czar]

I'm running a network of 100+ workstations plus lots more servers, printers and other stuff and too bad for us we are running it on some outdated 3com hubs and switches (seriously need to get propper cisco switches)

the problem is because of internal software we cant use dhcp so each computer is assigned an ip address manualy, a pain in the ass, more of a pain in the ass is that one ip I had reserved for a new server is being used by some unknown computer. I can see one share which I have no access to, I cant connect to the c$ share because it gives me access denied. It has 4 ports open none wich gives me any idea where the computer is.

Anyone here know of a good way for me to find this machine?

 

[wlee]

You could d'load the trial ver of LANGUARD I think it works for 30 days. I haven't used it in quite some time. It should help you track down the rogue.

 

[Cscutch]

If you use DNS on your Lan

nslookup "IP Address"

Find the computer name and hopefully that helps.

 

[bgroff]

If you have managed switches, you can use that feature to track down what port its coming from. In order to do this, you need the MAC address of the computer in question. You can get this by pinging the IP on the same subnet and looking in your arp tables. Then you get to dig through switch forwarding tables to see what port the MAC is being learned from.

 

[Cscutch]

Also in the future you should develop and maintain a spreadsheet of all used IPs and what machine and location they are being used at. For situtations like this don't happen.

It could be worse, say that PC was off and then you add that server running a mission critical app onto the network. Someone turns that PC on you get a conflict and users can't access the app, company loses big dollars, boss not happy.

Chris

 

[n0cmonkey]

Originally posted by: Cscutch
Also in the future you should develop and maintain a spreadsheet of all used IPs and what machine and location they are being used at. For situtations like this don't happen.

It could be worse, say that PC was off and then you add that server running a mission critical app onto the network. Someone turns that PC on you get a conflict and users can't access the app, company loses big dollars, boss not happy.

Chris

It sounds like he does keep track, just that someone tossed a machine on the network that shouldn't be there.

 

[w0ss]

If you have some type of firewall or router you could block the IP. Hopefully the user will then change the IP. Other thing is get the Mac address of the ip. With the Mac you can get the manufacturer of the nic.