Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 227
  • Last Modified:

Rouge System

This might sound like a simple question but I am kind of new to the security side of networking.  How am I able to find a rouge system on my network?  I ran GFI's Langaurd and it came back with the IP address it is using and also says it is probably a Unix box.  It is running Samba 2.2.3a(build26).  But when I look for it in active directory users and computers it does not show up.  The Unix box has three open ports 139,110,25.  I can ping it but can't trace it down.  Any suggestions are exteremly invited.


Thank you,
Erick
0
ebouza
Asked:
ebouza
1 Solution
 
cfairleyCommented:
Erick,

I would not show up in AD because it does not have a Domain account.  I would try the following:
nslookup "ip address"

This should give you the DNS name for the box.  Also, search for the IP address in DHCP and/or WINS to get the name for the box.

Just some suggestions, I'm not a security expert either.

Thanks,
0
 
dlwyatt82Commented:
If you already have the machine's IP addres, but don't know where to physically find it, I hope you have a managed switch :)
The LanGuard software you mentioned may have also given you the MAC address of the rogue system. If it didn't, you can obtain this information through windows by:

Going to a Windows PC on the same subnet as the rogue system
Pinging the rogue system's IP address.
Run "arp -a" from a command prompt to get the MAC address.

Once you have that, log onto your managed switch for that vlan / subnet, and find out which port the rogue system is plugged into. Once you know which port the culprit is using, you can walk straight to the PC and find out what's going on (assuming you have well-documented cable runs between your patch panel and wall jacks). You also have the option of just unplugging the rogue system's network cable from the switch if you are worried about security and you are sure it is NOT supposed to be on your network.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Building an Effective Phishing Protection Program

Join Director of Product Management Todd OBoyle on April 26th as he covers the key elements of a phishing protection program. Whether you’re an old hat at phishing education or considering starting a program -- we'll discuss critical components that should be in any program.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now