Avatar of J.R. Sitman
J.R. Sitman
Flag for United States of America asked on

how do I find an IP address of a computer on our network if I don't the range

We changed our ip addresses from 172.16.1.1 to 172.18.1.1 but one of the computers had a static address and I don't know what it was.  How do I find that rogue computer.  I know it's FQDN but that didn't help.  I tried doing a scan of 172.16.1.1, thru .255, but it doersn't show up.  I'm not physically at the machine or I could use ipconfig /all
Active Directory

Avatar of undefined
Last Comment
Shane McKeown

8/22/2022 - Mon
Shane McKeown

What did you use to do the scan of 172.16.1.1-254?

In order to scan that subnet you need the scanning machine to be in the same subnet(i.e. you mention you changed your IP from 16 to 18

Change the IP back and then do the scan and you'll find the pc you are looking for...
yo_bee

I have a basic ping script that will loop through an entire subnet.
This will return a True or False if online

Set objShell = CreateObject("WScript.Shell")


Dim i, ip 

ip = inputbox("Enter Subnet" & vbcrlf & "Exampled 192.168.0")
For i = 1 to 255
Set objExec = objShell.Exec("ping -n 1 -w 1000 " & ip & "." & i)
strPingResults = LCase(objExec.StdOut.ReadAll)
If InStr(strPingResults, "reply from") Then
wscript.echo ip & "." & i & vbtab & "True"
Else
wscript.echo ip & "." & i & vbtab & "False"
End If
next

Open in new window

J.R. Sitman

ASKER
I used WSping Pro.  I already tried scanning the .16 and .18.  

@yo_bee, can you tell me how to run the script?  details, please.
I started with Experts Exchange in 2004 and it's been a mainstay of my professional computing life since. It helped me launch a career as a programmer / Oracle data analyst
William Peck
Shane McKeown

Sorry can you give more details on what you are trying to do?
What's the output from ipconfig/all on your pc?

I assume you are trying to find an IP address that is already in use somewhere? The scanning software you have will work, but if you are setup in the 172.16.1.1/24 subnet and try to scan the 172.18.1.1/24 subnet it won't work obviously...

On your client machine set the subnet mask to 255.255.0.0(instead of 255.255.255.0) and re-scan and it should work...
Shane McKeown

Sorry, make the subnet 255.0.0.0(not 255.255.0.0) to get the scan to work...
wolfcamel

surely its on the same subnet as you used to have?
Have you added an Ip such as 172.16.1.1 to your card so it is on both subnets, so you can ping/search for the old computer.
if you haven't then it will be trying to ping it via your default gateway.
⚡ FREE TRIAL OFFER
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.
yo_bee

Open notepad and paste the script in there.
Save as > ASCII File with a .vbs extension
Open Command Prompt.
type:   cscript File path and name of the vbs file
example:  cscript c:\PingComputers.vbs
Shane McKeown

Again my bad(not a good day)

Correct subnet mask is 255.240.0.0
This will mean you can scan the entire 172.16 - 172.31 subnet - and hence the scan should find what you are looking for...
J.R. Sitman

ASKER
The problem is I'm access the server remotely so I can't get to the physical computer or I would run ipconfig /all as I noted in my post.
All of life is about relationships, and EE has made a viirtual community a real community. It lifts everyone's boat
William Peck
ASKER CERTIFIED SOLUTION
Shane McKeown

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
See Pricing Options
Start Free Trial
GET A PERSONALIZED SOLUTION
Ask your own question & get feedback from real experts
Find out why thousands trust the EE community with their toughest problems.
finfrockg

"Sorry, make the subnet 255.0.0.0(not 255.255.0.0) to get the scan to work... -"

That won't work.  This lost computer will only respond based on its subnet mask.  If it was a /24 network, anything outside of that range of addresses, it will attempt to route to its default gateway.  
To find the computer - your best bet it to set your computer to the old default gateway address and run Wireshark on your computer, then you will capture any computer still using the old address scheme try to communicate beyond the local subnet.  A ping sweep would also good be a good choice.
Mike Kline

Have you tried using psexec from Microsoft, you can run commands against remote machines

http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx

From the help

This command executes IpConfig on the remote system with the /all switch, and displays the resulting output locally:

psexec \\marklap ipconfig /all


Nice script yo_bee - you should also post that to the TechNet script center

Thanks

Mike
Shane McKeown

'That won't work.  This lost computer will only respond based on its subnet mask.  If it was a /24 network, anything outside of that range of addresses, it will attempt to route to its default gateway. '

Good point @finfrockg - didn't think of that one...

Back to my original point - you need to change the server back to its original ip and re-run the scan to find this one...
⚡ FREE TRIAL OFFER
Try out a week of full access for free.
Find out why thousands trust the EE community with their toughest problems.
J.R. Sitman

ASKER
In my scan software I can't enter the full subnet.  See attached.
scan.jpg
Shane McKeown

Probably since the mask is 255.255.0.0 like I already said...with a mask of 255.255.0.0 it only allows you to change the last 2 octets of the address range...

But as @finfrockg mentions it probably makes no odds - as the remote machine will still have default GW set to the old 172.16.1.1 address(and thus not respond to anything...)

You said you know the machine name - any chance there's still a record for what IP it was using in your DNS records on the server?
hypercube

Just to be clear re:
'That won't work.  This lost computer will only respond based on its subnet mask.  If it was a /24 network, anything outside of that range of addresses, it will attempt to route to its default gateway. '

The lost computer will respond to anything it receives if it's set up to respond to ICMP/Pings at all.  
- It *is* the destination and it will receive the packets.
- If suitably configured it should respond.
- If the source (and thus the response destination) IP address is on a subnet different from the target computer's subnet then it will still respond but the next hop will be its gateway on its local subnet.
- I the latter happens, the responding packets will still be "on the wire".
- If the sending computer is on the same wire (i.e. physical LAN) then it may well receive the responding packets.  Well, at least they will be present on the wire even if not in a form that would elicit an action by the pinging computer.

What I don't know is if the packets destined for the sending computer using the local gateway as the next hop will be seen by the sending computer anyway and not rely on the hop.  I *think* so but can't explain why right now .. so I have some doubt.  If the gateway has a broader subnet that includes both subnets then it will often bounce the packets back out onto the LAN.  But some don't.  The necessary experiments are easy to run.

I don't see in any of the responses that the pinging computer is on this, that or another subnet.  There is no ipconfig /all from the pinging computer as asked.  So we remain in the dark re: "is the pinging computer on the appropriate subnet at all?"
This is the best money I have ever spent. I cannot not tell you how many times these folks have saved my bacon. I learn so much from the contributors.
rwheeler23
J.R. Sitman

ASKER
this worked.

Thanks for all the help
Shane McKeown

Good to know, glad you got sorted...