Disable a IP address on a single workstation?

[zaresa]

I have a single workstation with a static IP address that I need to disable.

I am concerned about this machine because it is not registered in WINS and my LAN analyzer is reporting that it probably is a Unix/Linux box (it shouldn't be). Also, I cannot PING this machine from the router although I can from any other client in the subnet. Nobody within the IT Dept. recalls statically assigning this address. Basically,I can't physically locate this machine and want to disable it by removing the IP address.

Is there a way I can do this? Changing the router config. will not work since all network resources are on the same subnet.

Thanks in advance for any help.

 

[mot98]

Hi Zaresa,

I assume that you are running DHCP as well on your network.

Try excluding that IP address in your DHCP manager, then configure the workstation to use DHCP to obtain an IP address. This should then allow the network to see the workstation fine.

Hope this helps... mot98


"Victory goes to the player who makes the next-to-last mistake."
- Chessmaster Savielly Grigorievitch Tartakower (1887-1956)

 

[SgtB]

mot98 -
If I understand, he/she cannot locate the offending machine at all.

I don't know of an easy way to find the machine at all. You can go to your hubs/switches. Set up a machine to continually ping it, then start yaking cables one by one until the ping times out. Thats the cable your ghost machine is using. Follow it to the offender.
A very low-tech answer, but its the only one I have for you. Maybe someone else has some ideas. ________________________________________
Check out

http://www.security-forums.com

 

[mot98]

Sorry...hadn't finished my coffee yet, and missed the "can't physically locate the machine" part...

I agree with SgtB. This is going to be hard. For removing the IP address, follow my idea for excluding it in your DHCP manager.

As for locating the machine, SgtB has a good plan, other than that I think your only option is to go hunting.

mot98


"Victory goes to the player who makes the next-to-last mistake."
- Chessmaster Savielly Grigorievitch Tartakower (1887-1956)

 

[zaresa]

Thanks everyone...I was hoping that there was an easier way than I suspected. Although we use DHCP the offending address is part of a range that is not part of the DHCP pool. These addresses are used soley for static mapping (i.e. servers).

 

[F1lby]

If its a Linux box the chances it may have some services running on it.. like SSH, FTP, SMTP, HTTP.
Download a copy of putty and try to connect to it using TELNET and SSH. Thats a good start - WHen connecting you should be told the machine name if its Linux (and the services are running).
Then try http'ing to it - Can u connect? What web server is it? It's at this point when the web part works you can often identify it - perhaps its a print/print server or something? Wait till after hours and disconnect each hub/switch in turn and wait for the offending IP address to go away. Then at least you know which segment its on. Then its down to individual unplugging to find the offending apparatus.


Rgds

P. Blythe

 

[Grenage]

If the machine is NT of some description, you can use the PSSHUTDOWN.exe utility to remotely shut down the PC.