Windows Forum

Ask something
Discussion Locked

Track MAC causing IP Conflicts?

0 helpful
10 replies

by Member 23177524

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I need some advice on how to track down some employees that have been changing or adding IP addresses to their computers. Our office reserves IP's for applications that require them and Internet access. Obviously someone is trying to get internet access with out asking for it. I have the MAC addresses of a couple of offenders, but without doing a manual computer by computer check for the MAC address I have no Idea on how to find the offenders.
Last night this IP hopping caused one of our simulation computers to lose network connectivity and the last 5 days of simulation work were lost. The heats on me to find the person and take them out for a horse whipping, but I have no idea how to find them.
INFO:
Network config: Lantastic, Netbeui,and some TCP/IP (This not my design but my job to clean up)
OS: W95 / W98 / NT4W / W2K
Media: Cat5e

Thanks
A@HD

10 replies

by mckaytech

If your network infrastructure includes managed switches, you might be able to retrieve the MAC information about connected devices from there.

But unless you're running SMS or some other network inventory tool, the only other way I know to do itwould be to do something like a Kixtart script to read the MAC addresses from the registry.

The other piece of guidance you have to work with is the MAC address itself. The first part of the MAC address is a manufacturer's identifier for the NICso from the MAC address and the IEEE Web site, you can at least figure out what brand of NIC the offender's computer has. That doesn't help much if you've standardized on one brand but if you have some 3Com, some Linksys, etc. you could at least narrow the field of candidates.

paul

by astute

There are different ways you can do this...

1. Use a utility like internet maniac (freeware) . Gives all kinds of conn info including arp and rarp.

http://network-spy.com/maniac.php

2. An alternative is to ping the broadcast mask of your subnet which will ping every host on the local subnet (you can't ping the entire network as you only communicate directly with nodes on the same subnet, all other requests are via the gateway so you would just get a ARP entry for the gateway)
then use arp -a & redirect the o/p to a file as the entries stay in arp cache for about 2 minutes.

3. The other way to do it is to check arp cache on your router ( sh arp on cisco) , which actually displays ip against mac address.

Good luck

by leo.valmores

If you are able to know the IP address of this offending computer (right immediately when you have the IP conflict), ping this IP address. If you get a reply with the ping; execute this from command line: nbtstat -A .

This will give you the PC's NETBIOS name, whether it belongs to a Unique or Group, whether it is registered; and finally gives you the MAC address.

With the NETBIOS name, you should have already a knowledge who the person is.

Hope this helps.

by marcusarealius

Been there done that....

I have a utiliy that will scan a subnet for MAC # Macine name and user_ID(logon Name)

If you want it...email me.

That way you can scan the list for the matching mac address and also create an archive in case it happens again

This discussion is closed to new replies.