Finding particular computer on the network

[sharapov]

Hello,

We have about 200 computers that get their IP addresses via DHCP. All computers have rendomly assighned names during initial installation. I recently noticed that one of the computers on the network is hogging several DHCP IP addresses. How can I find that computer? Can I make network card's lights blink on the affected machine or something? Any ideas?

 

[308win]

Easier way, You know the mac address from DHCP, so if your switches are manageable (I assume they are), find the mac address on the switches.

 

[sharapov]

308win,

Thank you for your reply. I can find the mac address, but I really need to find that computer. I think there some sort of malicious software is running on it. Any other ideas?

Thanks.

 

[308win]

Where are you finding the MAC address? Your DHCP server or the switch?

1.) Are your switches manageable? If so get a console session session and look up the offensive MAC address. It will be assigned to a port. On a Cisco device the command is sho mac. On switches with http interfaces you find the menu option for port addresses. If the port that the MAC address appears on is also the port that is cross connected to another switch, move on to the next switch and repeat the process. Identifying the port will lead you directly to the machine. Depending on the switches that you use you can also deny access to that MAC address and pretty soon you would assume someone will start complaining about their access. (Or block the ip addresses at your router/firewall and wait for the complaint.)
2.) If you have a RAS or some kine of dial in server it is very possible that that server is obtaining multiple addresses in proxy for the dial in clients and you have no problem.
3.) Another giveaway as to the identity would be to check the ARP table on your router. See if the MAC address appears with any other IP addresses outside of what your DHCP range is. If it is a dialup/RAS server, I would imagine that the device also has a static IP address which chould be identified in the ARP table. (That assumes that the server is in the routers ARP cache.)
4.) And a last idea, I don't know if it is possible with DHCP, but can you reserve an invalid IP address for that MAC address and then sit back and wait for the user to compalin?

 

[tharder]

Shut off the port or unplug the device on your switch. You'll get a call from whoever it is that can't use it. Believe me, this works very well. If you suspect there is a virus or malicious software on that device you don't want it attached to your network anyway...