How to get the IP address if there's no console access?

[hummer3331973]

Hi-

I have this device that we're trying to get in to. We neither have its console nor telnet password. I tried to mirror the port on the switch and hoping it will send-out Broadcast and show on my Wireshark its IP add. But we can't get any even if we recycle the power.

Any suggestion? Unfortuantely it doesn't have any "reset" button or that ROM option on Cisco devices.

Thanks.

 

[North323]

you can get a program that sweeps all IPs in the subnet. i cant remember the name (ping sweep maybe). if you physically have the device you can use password recovery (cisco) also

 

[burtsbees]

North---you may be thinking of something like Angry IP Scanner (free)...

/

tim@tim-laptop ~ $ sudo apt-get install windows
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Couldn't find package windows...Thank Goodness!

 

[North323]

yea that angry IP...it works good

 

[hummer3331973]

Thanks for the inputs.

Have tried using an IP scanner before, but isn't it you at least know which subnet? I tried the most common being used by most devices 192.168.0.0/24 but no replies.

This is a fairly old unit, and have no idea where it was used before.

 

[burtsbees]

You can set a computer up with an ip add of 0.0.0.0 with a mask of 0.0.0.0, then connect to the switch, and start Angry IP Scanner at subnet 0.0.0.0 and end at 192.168.255.254

Let it run for 2 days...lol

/

tim@tim-laptop ~ $ sudo apt-get install windows
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Couldn't find package windows...Thank Goodness!

 

[imbadatthis]

im just going to throw this out here...
if you have a switch , can't you just connect to the router, wait a bit and issue a show cdp neig det command ?

 

[lerdalt]

or even get the mac address from the switch and do a show arp

 

[ISPKing]

Wont have an arp entry unless it is contacted at layer 3 first Which he cant do. If it really has an ip address, wireshark it again and wait for the gratuitous arp request.

CCNP

 

[Cluebird]

sho cdp nei det or sh cdp entry * will give IP information

 

[Cluebird]

Why not just do a password recovery?

 

[hummer3331973]

Thanks for all the inputs. It will be a lot easier if this is a Cisco, but it is not.

I finally found the culprit. ISPKing is correct, the reason it is not appearing on Wireshark is the IP add disappeared on Fast-E interface for some reasons. Will be sending it to the vendor for repair.