how to solve IP address duplication in a LAN network 3

[dannydanny]

Hi,

Recently I installed a network cable printer in our office. I assigned it a fixed IP address, outside the scope of DHCP. It worked normally but suddenly all print jobs sent to it fail. The error message on the printer is that another device in the network has the same IP address, although I checked the address was definitely vacant prior to installation.

I unplugged th printer and could still ping the address, so somewhere in our network, some device has manually assigned itself the same IP address as the printer. My question is, are there any systematic methods of tracking down this device? other than to visit EVERY LAN capable device and checking the IP address......

Any help much appreciated.
Danny

PS. we are using W2K Pro machines with NT4 servers.

 

[Provogeek]

These can be difficult to track.

The MAC address should help narrow it down. Each vendor has an assigned MAC address header, this web site will tell you who. This will at least narrow it down to a few machines or devices on your network so you only have to check those devices.

http://www.cavebear.com/CaveBear/Ethernet/vendor.html

Provogeek

Saving the world, one network at a time

 

[tcambridge]

Do you have DNS running on your network? If so, query DNS with the IP address and it should return a hostname (provided that it has a host record) that will be able to help you track down the machine/device.

Is this a Windows network? You can use the following command to also return NetBIOS information:

nbtstat -A xxx.xxx.xxx.xxx (replace x's with the IP address)

Good Luck!

Tim
Certified AND Qualified

 

[dannydanny]

Thanks for the info, provogeek, Tim. I did as suggested and tracked down the manufacturer of the ethrenet device, using the arp -a command to get the ethernet address.

Turns out its another printer that has usurped the IP address of the original printer! But being IT manager of my office of 40 users, I don`t know anything about this rogue printer in our office, so I still have to find it and shut it down.
I suspect someone has installed a personal printer without my knowledge......

Anyway, thanks again!
Danny

 

[manarth]

"I suspect someone has installed a personal printer without my knowledge......"

Don't you just hate that?

Good luck!
Marc

 

[tcambridge]

Since you have the IP address, add the printer to your computer, send a document to it with your name on it and a statement saying to return it to you or give you a call.

Good Luck!



Tim
Certified AND Qualified

 

[zakaria]

Is this a Windows network? You can use the following command to also return name of PC
go to coomand prompt type c:\tracert ip
example c:\tracert 192.168.0.1
good luck

 

[pansophic]

If you are running a managed switch, you should be able to track down the network segement (maybe even the actual cable) by using arp on the switch. You could shut down that port and wait for the telephone call.

Run nmap (or nmapNT if you are a windows shop) and see if the printer runs a web management port. If so, you can probably point your web browser to it, and reconfigure it for the user.

nmap may accurately identify the printer make/model, and if it does, then you may be able to find vulnerabilities for that printer to cause the owner some real problems. After all, (s)he chose to install a rogue device on a network for which you are responsible. I would not make it painless for this individual.

In the mean time, I'd just change the IP address of the production printer and get it operational again. In all likelihood, people point to the printer by name, not IP address, so the change should be transparent to everyone else.


pansophic

 

[Kjonnnn]

Check WINS.

 

[Breakerfall]

Giving the production printer an IP outside the DHCP scope only guarantees that the mentioned IP won’t be given to any host requesting an IP from the DHCP server, but doesn’t prevent from another host (using manually assigned IP) to steal that IP. To achieve that, you need to create “reservation(s)” for the printer(s) in the DHCP Server, using the devices’ MAC address.

Hope that helps,
KUP, thanks.

 

[Breakerfall]

Also, if you are still having problems identifying the conflicting device, you could use “GFI Languard Network Scanner” to search for host/devices in a range of given IP’s or you can simply type in a single IP. It’s a great program.