Find and document unauthorized device

[Chaoscorpz]

Hello,

I have a user whom is jacking in an unauthorized laptop/device into my network. We have a good idea of who it is, but need to provide evidence of the occurrences. This user is particularly troublesome as he has used his technical knowledge to undermine/discredit my IT department with administration. Time to spank a user.

What I need is to trace it down to a specific port on my switch-gear, and from there, a specific wall plate/location. If I could also glean any extra info out of the device that would be great as well. I've been given authorization from upper management to conduct a quiet investigation and have been assured it will be pursued with HR.

The user either unplugs one of the normal company PC's and users that jack, or has found an active one. The user gets an IP from my DHCP server, and goes on his merry way with the network.

I can tell that this is an unauthorized device since the device name does not follow my standard conventions, and the MAC address traces out to a different manufacturer than we use (from the DHCP server log).

This is what I have to work with:
Complete admin/root level access to everything on out network.
Windows 2000 DHCP servers
Windows 2000 Servers
Core switch gear is Cisco 3750's
Other Switch gear Cisco 3550's, and 3Com SuperStack III's
Cisco PIX firewalls for Internet access.

My skill set:
Familiar with MS servers & desktops.
Some UNIX/Linux knowledge.
Some 3Com experience
Some Cisco experience.
Determination to bust him.


I am, willing to drop dedicated appliance PCs to nail this user down. I've built dedicated appliance PCs before for use as firewalls, routers, print servers, etc.

To cover my bases I've dropped this into a couple of related forums.



Any ideas?

Thanks in advance,

IT

 

[tfg13]

CicsoGuy33 has a pretty good idea from one of the other threads in this forum:

CiscoGuy33 (Instructor)
2 Jun 06 8:44
Glenn

What kind of switch ports are they connecting to, I know that with most Cisco switches you can turn on port security and then lock the MAC address of the computers that should be plugged in to that port, if they unplug and plug in a different device the port will shut down.

Then you will know exactly who did it and they would be without any connection until you could reset the port smile

Just a thought!

E.A. Broda
CCNA, CCDA, CCAI, Network +

 

[CiscoGuy33]

tfg13,

Thanks! I couldn't have said it better myself!

I would love to be there if the port shut down and he could not reconnect the regular computer - he would have to call a help ticket!!




E.A. Broda
CCNA, CCDA, CCAI, Network +

 

[tfg13]

I totally agree. We've done it at my current place of employment, and to see the embarassment of the individual as they stammer on why the switch tripped is pretty good....

 

[jrbarnett]

Set up a DHCP reservation for this MAC address that doesn't include a default gateway - so he won't be able to connect out from the local subnet.

He would know this as soon as he tried to connect to any hosts outside the current subnet and failed.

If you're feeling really nasty, you could even give it an IP range from one you don't use to stop it communicating with anything (eg if you use 192.168.1.0/24 for your normal LAN, give it 10.0.0.1/24).
Combine this with the router instructions above, and you've got a machine unable to do anything (unless he's into cloning MAC addresses, but that's a different story).

John

 

[mrn]

Have a play with him first

http://www.topshareware.com/LanShutDown-download-35807.htm

&

http://www.shareup.com/LanSpy-download-29806.html

Mike

"A foolproof method for sculpting an elephant: first, get a huge block of marble, then you chip away everything that doesn't look like an elephant."

http://www.airport-parking-site.co.uk/

 

[Auger282]

we use Fluke software to monitor our network.. if you can track the IP you can get the mac.. with the mac you can find the switch port.. but as for catching someone in the act I always suggest a hidden network attached webcam ;]