Windows Forum

Ask something
Discussion Locked

finding a misplaced computer

0 helpful
8 replies

by thobert

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
one of my workstations have been tranfered in the company. i need to find where it went for administrative purposes. the computer name has been changed and may have been reimaged at this point. I do know its MAC address. i have located things using ping and ntbstat. is there a utility that will give me it's netbios name or ip address by using its hardware address?

8 replies

by timthetoolman

Hi,

Yep.

arp -a IPAddress

Will give you the MAC address for the IP address.

For example...

E:\Documents and Settings\Tim Medhurst>arp -a 192.168.0.1

Interface: 192.168.0.3 --- 0x2
Internet Address Physical Address Type
192.168.0.1 00-80-29-63-bb-e4 dynamic

...gives me the MAC address of my internet gateway server.

You could do an arp sweep for all known IP addresses in your network to a log file and search it for the MAC address.

Cheers,Tim.

by thobert

good idea Tim and I had not thought of that but my network has over 40,000 non contiuous ip addresses. I'm worried about time and effort vs. results.

by timthetoolman

Hi,

It wouldn't be a lot of effort...but may take a day or two to complete. It doesn't matter that your network is non contiguous...

If you have any ability with DOS scripting you'd do it in two loops. Something like (and this isn't at all tested...

set i=1
set j=1
loop1:
loop2:
set ipaddr=192.168.%i%.%j%
arp -a %ipaddr% >> findit.log
set /a j=%j%+1
if %j%=255 goto cont1
goto loop2
cont1:
set j=1
set /a i=%i%+1
if %i%=255 goto finished
goto loop1
finished:

As I said - I only wrote that on the fly - its not tested but running it (or at least the bug free version :-) ) and searching the result for the MAC address will give you the result you want with no "effort" on your part.

Cheers,
Tim.

by timthetoolman

...and I decided to test it... A couple of syntax errors and you need to ping the address first. Here's the code.

set i=0
set j=0
:loop1
:loop2
set ipaddr=192.168.%i%.%j%
ping -n 1 %ipaddr%
arp -a %ipaddr% >> findit.log
set /a j=%j%+1
if %j%==255 goto cont1
goto loop2
:cont1
set j=0
set /a i=%i%+1
if %i%==255 goto finished
goto loop1
:finished

For me it was doing about 17 per minute. So it'll take about 63 hours to run. At least it'll give you an answer.

Careful when you copy and paste it. Dont let it past spaces at the end of each line like it did for me.

Cheers,
Tim.

by timthetoolman

One last thing. To speed it up, run several in parallel. If you alter the "i" values to be on the "16" boundaries, then you could run 16 at once and it would be done in 4 hours.

For example

set i=16
...
if %i%==32 goto finished

set i=32
...
if %i%==48 goto finished

etc.

You could parameterise the thing if you wanted, too. Something like...

set i=%1%
set /a imax=%i%+16
...
if %i%==%imax% goto finished

Cheers,
Tim.

This discussion is closed to new replies.