Link to home
Start Free TrialLog in
Avatar of J.R. Sitman
J.R. SitmanFlag for United States of America

asked on

how do I find an IP address of a computer on our network if I don't the range

We changed our ip addresses from 172.16.1.1 to 172.18.1.1 but one of the computers had a static address and I don't know what it was.  How do I find that rogue computer.  I know it's FQDN but that didn't help.  I tried doing a scan of 172.16.1.1, thru .255, but it doersn't show up.  I'm not physically at the machine or I could use ipconfig /all
Avatar of Shane McKeown
Shane McKeown
Flag of Ireland image

What did you use to do the scan of 172.16.1.1-254?

In order to scan that subnet you need the scanning machine to be in the same subnet(i.e. you mention you changed your IP from 16 to 18

Change the IP back and then do the scan and you'll find the pc you are looking for...
Avatar of yo_bee
I have a basic ping script that will loop through an entire subnet.
This will return a True or False if online

Set objShell = CreateObject("WScript.Shell")


Dim i, ip 

ip = inputbox("Enter Subnet" & vbcrlf & "Exampled 192.168.0")
For i = 1 to 255
Set objExec = objShell.Exec("ping -n 1 -w 1000 " & ip & "." & i)
strPingResults = LCase(objExec.StdOut.ReadAll)
If InStr(strPingResults, "reply from") Then
wscript.echo ip & "." & i & vbtab & "True"
Else
wscript.echo ip & "." & i & vbtab & "False"
End If
next

Open in new window

Avatar of J.R. Sitman

ASKER

I used WSping Pro.  I already tried scanning the .16 and .18.  

@yo_bee, can you tell me how to run the script?  details, please.
Sorry can you give more details on what you are trying to do?
What's the output from ipconfig/all on your pc?

I assume you are trying to find an IP address that is already in use somewhere? The scanning software you have will work, but if you are setup in the 172.16.1.1/24 subnet and try to scan the 172.18.1.1/24 subnet it won't work obviously...

On your client machine set the subnet mask to 255.255.0.0(instead of 255.255.255.0) and re-scan and it should work...
Sorry, make the subnet 255.0.0.0(not 255.255.0.0) to get the scan to work...
surely its on the same subnet as you used to have?
Have you added an Ip such as 172.16.1.1 to your card so it is on both subnets, so you can ping/search for the old computer.
if you haven't then it will be trying to ping it via your default gateway.
Open notepad and paste the script in there.
Save as > ASCII File with a .vbs extension
Open Command Prompt.
type:   cscript File path and name of the vbs file
example:  cscript c:\PingComputers.vbs
Again my bad(not a good day)

Correct subnet mask is 255.240.0.0
This will mean you can scan the entire 172.16 - 172.31 subnet - and hence the scan should find what you are looking for...
The problem is I'm access the server remotely so I can't get to the physical computer or I would run ipconfig /all as I noted in my post.
ASKER CERTIFIED SOLUTION
Avatar of Shane McKeown
Shane McKeown
Flag of Ireland image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
"Sorry, make the subnet 255.0.0.0(not 255.255.0.0) to get the scan to work... -"

That won't work.  This lost computer will only respond based on its subnet mask.  If it was a /24 network, anything outside of that range of addresses, it will attempt to route to its default gateway.  
To find the computer - your best bet it to set your computer to the old default gateway address and run Wireshark on your computer, then you will capture any computer still using the old address scheme try to communicate beyond the local subnet.  A ping sweep would also good be a good choice.
Have you tried using psexec from Microsoft, you can run commands against remote machines

http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx

From the help

This command executes IpConfig on the remote system with the /all switch, and displays the resulting output locally:

psexec \\marklap ipconfig /all


Nice script yo_bee - you should also post that to the TechNet script center

Thanks

Mike
'That won't work.  This lost computer will only respond based on its subnet mask.  If it was a /24 network, anything outside of that range of addresses, it will attempt to route to its default gateway. '

Good point @finfrockg - didn't think of that one...

Back to my original point - you need to change the server back to its original ip and re-run the scan to find this one...
In my scan software I can't enter the full subnet.  See attached.
scan.jpg
Probably since the mask is 255.255.0.0 like I already said...with a mask of 255.255.0.0 it only allows you to change the last 2 octets of the address range...

But as @finfrockg mentions it probably makes no odds - as the remote machine will still have default GW set to the old 172.16.1.1 address(and thus not respond to anything...)

You said you know the machine name - any chance there's still a record for what IP it was using in your DNS records on the server?
Just to be clear re:
'That won't work.  This lost computer will only respond based on its subnet mask.  If it was a /24 network, anything outside of that range of addresses, it will attempt to route to its default gateway. '

The lost computer will respond to anything it receives if it's set up to respond to ICMP/Pings at all.  
- It *is* the destination and it will receive the packets.
- If suitably configured it should respond.
- If the source (and thus the response destination) IP address is on a subnet different from the target computer's subnet then it will still respond but the next hop will be its gateway on its local subnet.
- I the latter happens, the responding packets will still be "on the wire".
- If the sending computer is on the same wire (i.e. physical LAN) then it may well receive the responding packets.  Well, at least they will be present on the wire even if not in a form that would elicit an action by the pinging computer.

What I don't know is if the packets destined for the sending computer using the local gateway as the next hop will be seen by the sending computer anyway and not rely on the hop.  I *think* so but can't explain why right now .. so I have some doubt.  If the gateway has a broader subnet that includes both subnets then it will often bounce the packets back out onto the LAN.  But some don't.  The necessary experiments are easy to run.

I don't see in any of the responses that the pinging computer is on this, that or another subnet.  There is no ipconfig /all from the pinging computer as asked.  So we remain in the dark re: "is the pinging computer on the appropriate subnet at all?"
this worked.

Thanks for all the help
Good to know, glad you got sorted...