Rouge System

This might sound like a simple question but I am kind of new to the security side of networking.  How am I able to find a rouge system on my network?  I ran GFI's Langaurd and it came back with the IP address it is using and also says it is probably a Unix box.  It is running Samba 2.2.3a(build26).  But when I look for it in active directory users and computers it does not show up.  The Unix box has three open ports 139,110,25.  I can ping it but can't trace it down.  Any suggestions are exteremly invited.


Thank you,
Erick
ebouzaAsked:
Who is Participating?

[Webinar] Streamline your web hosting managementRegister Today

x
 
dlwyatt82Connect With a Mentor Commented:
If you already have the machine's IP addres, but don't know where to physically find it, I hope you have a managed switch :)
The LanGuard software you mentioned may have also given you the MAC address of the rogue system. If it didn't, you can obtain this information through windows by:

Going to a Windows PC on the same subnet as the rogue system
Pinging the rogue system's IP address.
Run "arp -a" from a command prompt to get the MAC address.

Once you have that, log onto your managed switch for that vlan / subnet, and find out which port the rogue system is plugged into. Once you know which port the culprit is using, you can walk straight to the PC and find out what's going on (assuming you have well-documented cable runs between your patch panel and wall jacks). You also have the option of just unplugging the rogue system's network cable from the switch if you are worried about security and you are sure it is NOT supposed to be on your network.
0
 
cfairleyCommented:
Erick,

I would not show up in AD because it does not have a Domain account.  I would try the following:
nslookup "ip address"

This should give you the DNS name for the box.  Also, search for the IP address in DHCP and/or WINS to get the name for the box.

Just some suggestions, I'm not a security expert either.

Thanks,
0
All Courses

From novice to tech pro — start learning today.