How to Find Devices on a Network

networking

How do I scan a network to find out which devices are on it? (I'd be happy with a list of MAC addresses and IPs.)

For example, lets say I'm at work and want to be sure that there are no unknown devices connected to the network (especially if access is not filtered by password or MAC). DHCP logs could help, but what if I want to find devices with static IPs?

Alternatively, let us say I'm at a friends house and he wants me to setup port forwarding, but doesn't know the IP of his router. Sure, a few good guesses will usually get it, but it'd be nicer to scan.

Best Answer

For the first scenario, look at nmap. You can scan entire subnets in one command. For example: nmap -sP 192.168.0.1/24

For the second, the router IP should show up as the gateway IP for your machine. In windows, that appears in the connection status dialog.

Related Solutions

Switch – Finding (and stopping!) Rogue Devices from HP Procurve

I can't tell you a thing about "blocking" or access-control-list functionality in HP Procurve switches. In general, "blocking" unwanted devices isn't a good thing. Stopping the wanted devices from getting on your network in the first place is a better idea.

To find the MAC address of an offending device, from a computer on the same subnet as that device, PING the device and then do an "arp -a" from a command prompt. You should get back something like this (on Windows):

Interface: 192.168.28.10 --- 0x6
  Internet Address      Physical Address      Type
  192.168.28.9          00-ff-22-71-a6-a2     dynamic

The MAC address is listed under the "physical address" column.

Hopefully the ProCurve switches have some functionality to allow you search the MAC address database on the switch for a given address. Do that, and the switch will tell you which port it is "seeing" that MAC address attached to.

On a Cisco switch (or a "Cisco-workalike" switch), you'd do:

show mac-address | include xxxx.xxxx.xxxx

Where the x's are the MAC address (removing the "-" between the digits that Windows reports and placing "." between each group of 4 digits).

Track down what's plugged into that port. If it's another switch, repeat the process on the other switch. If you end up with a wireless access point think about using (better) encryption to keep unauthorized parties off your network.

Cisco – How to get DHCP scope information from a Cisco device? (IOS 12)

From the relevant device, try show ip dhcp pool. To show exclusions, try show run | i excluded-addresses.

The following output is from a Cisco 4507 switch.

CORE#show ip dhcp pool

Pool VOICE :
 Utilization mark (high/low)    : 100 / 0
 Subnet size (first/next)       : 0 / 0 
 Total addresses                : 254
 Leased addresses               : 42
 Excluded addresses             : 101
 Pending event                  : none
 1 subnet is currently in the pool :
 Current index        IP address range                    Leased/Excluded/Total
 192.168.122.234      192.168.122.1    - 192.168.122.254   42    / 101   / 254  


Pool GUEST :
 Utilization mark (high/low)    : 100 / 0
 Subnet size (first/next)       : 0 / 0 
 Total addresses                : 254
 Leased addresses               : 9
 Excluded addresses             : 103
 Pending event                  : none
 1 subnet is currently in the pool :
 Current index        IP address range                    Leased/Excluded/Total
 192.168.111.165      192.168.111.1    - 192.168.111.254   9     / 103   / 254

And exclusions:

CORE#show run | i excluded-addresses
ip dhcp excluded-address 192.168.122.1 192.168.122.50
ip dhcp excluded-address 192.168.122.100 192.168.122.150
ip dhcp excluded-address 192.168.111.1 192.168.111.50
ip dhcp excluded-address 192.168.111.100 192.168.111.150

Best Answer

Related Solutions

Switch – Finding (and stopping!) Rogue Devices from HP Procurve

Cisco – How to get DHCP scope information from a Cisco device? (IOS 12)

Related Topic