unknonwn IP address

Posted on 2012-08-28
Last Modified: 2012-08-28
We did an IP scan on our network and found an IP address that we could not pinpoint back to a device.

I have tried telnet,ssh, traceroute, ping.

Are there any other commands that i can use to figure what this device is?

Can I shut it down or block this device?
Question by:MECIT
    LVL 24

    Expert Comment

    by:Ken Boone CCIE #4649
    Well ping the ip address and then look at your arp table to find the mac address of the device.  Then if you have a managed switch you should be able to find the port that that mac address lives off of.   Then either you can track it down by cables to find it, or just shut the port down and see who screams.
    LVL 13

    Assisted Solution

    You can ping the machine and then do an arp -a from the command prompt.  Get the MAC Address of the machine and then check your switches for where that MAC address is.  If you have WLAN this would be easier as you've got a list of attached devices by MAC address on one screen.

    Once you've isolated the port that it's plugged into you should be able to trace back to where it's physically connected on the network.  

    Not a pretty solution and may take some time...but it will work  :-)
    LVL 7

    Assisted Solution

    You could try using Netscan

    Then add the MAC/vendor address database. Then it may give you some clue who the vendor is.

    If you can find out the switch port the MAC address is on, you can shut it the switchport down and track it from there

    show mac-address-table

    if you have a cisco switch and trace it back to the port
    LVL 13

    Expert Comment

    If it's a wireless device....could be phone.  You can stop the MAC Address thru MAC Address filtering and as Ken pointed out, wait until someone screams.  

    Additionally, you can do a vendor lookup for the mac address to get an idea of what the device is:

    Could give you an idea if it's a phone or an HP device or a Broadcom NIC.

    Author Comment

    I found the mac address . I have Dell 6248 switches so what would be the commands to see the mac addresses.

    I tried the but could not find anything.
    LVL 24

    Accepted Solution


    Author Closing Comment

    thanks for the help. We figured out what it was. An apple tv we were testing.

    Featured Post

    What Is Threat Intelligence?

    Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

    Join & Write a Comment

    Suggested Solutions

    Title # Comments Views Activity
    Network traffic 7 16
    remove chinese softwares 22 83
    Identifying location based on IP address 13 73
    Find VLAN ID's 6 26
    Configuring network clients can be a chore, especially if there are a large number of them or a lot of itinerant users.  DHCP dynamically manages this process, much to the relief of users and administrators alike!
    Today, still in the boom of Apple, PC's and products, nearly 50% of the computer users use Windows as graphical operating systems. If you are among those users who love windows, but are grappling to keep the system's hard drive optimized, then you s…
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…
    In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor ( If you're interested in additional methods for monitoring bandwidt…

    745 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    16 Experts available now in Live!

    Get 1:1 Help Now