IP address conflict

by: rickiswpgPosted on 2008-03-10 at 12:47:36ID: 21089722

Is it a conflict with your DC and another system or 2 systems?

You could run nmap on your network. It Displays IP addresses, device name, and and mac address.

http://nmap.org/download.html

by: droydenPosted on 2008-03-10 at 12:47:43ID: 21089728

You could try this program:

http://www.youngzsoft.net/cc-get-mac-address/

Alternately If you can change the IP of the DC temporarily then you could try to use WINS to resolve the IP (the conflict) into the PC name using:

ping -a ip

from a dos prompt.

by: jkrPosted on 2008-03-10 at 13:47:32ID: 21090259

Open a Command Prompt and type

arp -a

and locate the MAC adress on the list that is shown.

by: mattlebPosted on 2008-03-10 at 15:03:51ID: 21090899

If you have access to the local network switches you can issue a "show ip arp" command if Cisco or "show arp" if Foundry.
There may be a lot of devices so you can filter the output for your specific IP "show arp | inc 10.10.10.x"
Hope this helps.

by: droydenPosted on 2008-03-10 at 15:21:46ID: 21091022

he has the mac address already guys

another idea I just thought of is if you are part of a domain you could try to see what services the IP is running, if its on the domain try to connect to c$ share. See if its running a webserver etc etc, you may be able to figure out what the machine is called from that.
you can use nmap (www.nmap.org) to finger print it and see what OS it is running - nmap will also map the MAC address to the manufactuer which may also help figuring out what the device is.

Thanks

by: alan2938Posted on 2008-03-10 at 15:29:17ID: 21091071

Ya, I downloaded nmap and started an intensive scan on my entire subnet about 2 hours ago.... I learned the hard way that I should have just done the specific IP in question. Oh well. Maybe I'll find out some other useful information once the scan is complete.

But yes you are correct, I already have the MAC address. I need to try and trace it to a computer.

by: mattlebPosted on 2008-03-10 at 21:04:51ID: 21092964

If you have the Mac then you can track down which port on the switch it is connected to.

by: alan2938Posted on 2008-03-11 at 06:31:42ID: 21095489

When I use nmap it just shows results for my domain controller, not the machine that is conflicting with it. Also, none of my switches are managed except my gateway (Cisco 1800 series) so I can't track down a MAC address from the switch.

by: rickiswpgPosted on 2008-03-11 at 06:46:01ID: 21095629

Hmmm, well aside from temporarily changing the ip of your DC I'm not sure how you are going to be able to find it. You could change the ip of your dc, nmap the ip in question. That should give you a computer name.

I'd do this after hours of course.

Anyone else got any ideas?

by: alan2938Posted on 2008-03-11 at 06:51:51ID: 21095687

I went ahead and changed the IP of my dc. The scan result from the nmap didn't really give me anything useful. It showed that only telnet and http ports were open. Here are the fingerprints from the scan:

Not shown: 1712 closed ports
PORT   STATE SERVICE VERSION
23/tcp open  telnet?
80/tcp open  http?
|_ HTML title: Site doesn't have a title.
2 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port23-TCP:V=4.53%I=7%D=3/11%Time=47D68B1E%P=i686-pc-windows-windows%r(
SF:NULL,C,"\xff\xfb\x03\xff\xfd\x01\xff\xfd\x1f\xff\xfb\x05")%r(GenericLin
SF:es,C,"\xff\xfb\x03\xff\xfd\x01\xff\xfd\x1f\xff\xfb\x05")%r(GetRequest,C
SF:,"\xff\xfb\x03\xff\xfd\x01\xff\xfd\x1f\xff\xfb\x05")%r(HTTPOptions,C,"\
SF:xff\xfb\x03\xff\xfd\x01\xff\xfd\x1f\xff\xfb\x05")%r(RTSPRequest,C,"\xff
SF:\xfb\x03\xff\xfd\x01\xff\xfd\x1f\xff\xfb\x05");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port80-TCP:V=4.53%I=7%D=3/11%Time=47D68B1E%P=i686-pc-windows-windows%r(
SF:GetRequest,101,"HTTP/1\.1\x20403\x20Forbidden\r\nServer:\x20GoAhead-Web
SF:s\r\nPragma:\x20no-cache\r\nCache-Control:\x20no-cache\r\nContent-Type:
SF:\x20text/html\r\n\r\n<html><head><title>Forbidden</title></head>\r\n\x2
SF:0\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20<body><h2>
SF:Access\x20Denied:\x20Access\x20to\x20the\x20Server\x20is\x20Disabled</h
SF:2>\r\n</body></html>\r\n")%r(HTTPOptions,13C,"HTTP/1\.1\x20400\x20Page\
SF:x20not\x20found\r\nServer:\x20GoAhead-Webs\r\nPragma:\x20no-cache\r\nCa
SF:che-Control:\x20no-cache\r\nContent-Type:\x20text/html\r\n\r\n<html><he
SF:ad><title>Document\x20Error:\x20Page\x20not\x20found</title></head>\r\n
SF:\t\t<body><h2>Access\x20Error:\x20Page\x20not\x20found</h2>\r\n\t\twhen
SF:\x20trying\x20to\x20obtain\x20<b>\(null\)</b><br><p>Bad\x20request\x20t
SF:ype</p></body></html>\r\n\r\n")%r(RTSPRequest,13C,"HTTP/1\.1\x20400\x20
SF:Page\x20not\x20found\r\nServer:\x20GoAhead-Webs\r\nPragma:\x20no-cache\
SF:r\nCache-Control:\x20no-cache\r\nContent-Type:\x20text/html\r\n\r\n<htm
SF:l><head><title>Document\x20Error:\x20Page\x20not\x20found</title></head
SF:>\r\n\t\t<body><h2>Access\x20Error:\x20Page\x20not\x20found</h2>\r\n\t\
SF:twhen\x20trying\x20to\x20obtain\x20<b>\(null\)</b><br><p>Bad\x20request
SF:\x20type</p></body></html>\r\n\r\n")%r(FourOhFourRequest,101,"HTTP/1\.1
SF:\x20403\x20Forbidden\r\nServer:\x20GoAhead-Webs\r\nPragma:\x20no-cache\
SF:r\nCache-Control:\x20no-cache\r\nContent-Type:\x20text/html\r\n\r\n<htm
SF:l><head><title>Forbidden</title></head>\r\n\x20\x20\x20\x20\x20\x20\x20
SF:\x20\x20\x20\x20\x20\x20\x20\x20\x20<body><h2>Access\x20Denied:\x20Acce
SF:ss\x20to\x20the\x20Server\x20is\x20Disabled</h2>\r\n</body></html>\r\n"
SF:);
MAC Address: 00:30:AB:23:95:85 (Delta Networks)
No OS matches for host

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:

Select all Open in new window

by: rickiswpgPosted on 2008-03-11 at 07:00:37ID: 21095765

It's showing Delta Networks next to the MAC Address... I wonder if it's a switch or something else.

Do you have anything made by delta networks? http://www.dninetworks.com

by: alan2938Posted on 2008-03-11 at 07:47:21ID: 21096197

Hm... tracked it down to my Dell PowerConnect 3024. I have no reason why this has happened now since I haven't changed any configuration in over a month. Thanks for your help!

by: rickiswpgPosted on 2008-03-11 at 09:01:52ID: 21097049

Glad you found it. Kind of weird that it would just start doing that though.

Question

IP address conflict - need to find computer name from MAC address

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

Windows Programming

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Need individual assistance?

Our experts are ready to help.

Want to learn from the best?

Read articles from industry experts.

Working on a long term project?

Store your work and research.

What Makes Experts Exchange Unique?

Trusted by the world's most respected brands.

Faithfully serving IT professionals since 1996.

Related Solutions

Free Tech Articles

Cloud Class Webinars

Join the Community

Give a Little. Get a Lot.

Answers

3 Ways to Join

The Experts

The Experts

Testimonials

Testimonials

Testimonials

Business Clients

Business Clients

In the Press

In the Press

In the Press