Solved

how do I find an IP address of a computer on our network if I don't the range

Posted on 2013-01-06
18
487 Views
Last Modified: 2013-01-06
We changed our ip addresses from 172.16.1.1 to 172.18.1.1 but one of the computers had a static address and I don't know what it was.  How do I find that rogue computer.  I know it's FQDN but that didn't help.  I tried doing a scan of 172.16.1.1, thru .255, but it doersn't show up.  I'm not physically at the machine or I could use ipconfig /all
0
Comment
Question by:jrsitman
  • 8
  • 4
  • 2
  • +4
18 Comments
 
LVL 24

Expert Comment

by:smckeown777
Comment Utility
What did you use to do the scan of 172.16.1.1-254?

In order to scan that subnet you need the scanning machine to be in the same subnet(i.e. you mention you changed your IP from 16 to 18

Change the IP back and then do the scan and you'll find the pc you are looking for...
0
 
LVL 21

Expert Comment

by:yo_bee
Comment Utility
I have a basic ping script that will loop through an entire subnet.
This will return a True or False if online

Set objShell = CreateObject("WScript.Shell")


Dim i, ip 

ip = inputbox("Enter Subnet" & vbcrlf & "Exampled 192.168.0")
For i = 1 to 255
Set objExec = objShell.Exec("ping -n 1 -w 1000 " & ip & "." & i)
strPingResults = LCase(objExec.StdOut.ReadAll)
If InStr(strPingResults, "reply from") Then
wscript.echo ip & "." & i & vbtab & "True"
Else
wscript.echo ip & "." & i & vbtab & "False"
End If
next

Open in new window

0
 

Author Comment

by:jrsitman
Comment Utility
I used WSping Pro.  I already tried scanning the .16 and .18.  

@yo_bee, can you tell me how to run the script?  details, please.
0
 
LVL 24

Expert Comment

by:smckeown777
Comment Utility
Sorry can you give more details on what you are trying to do?
What's the output from ipconfig/all on your pc?

I assume you are trying to find an IP address that is already in use somewhere? The scanning software you have will work, but if you are setup in the 172.16.1.1/24 subnet and try to scan the 172.18.1.1/24 subnet it won't work obviously...

On your client machine set the subnet mask to 255.255.0.0(instead of 255.255.255.0) and re-scan and it should work...
0
 
LVL 24

Expert Comment

by:smckeown777
Comment Utility
Sorry, make the subnet 255.0.0.0(not 255.255.0.0) to get the scan to work...
0
 
LVL 20

Expert Comment

by:wolfcamel
Comment Utility
surely its on the same subnet as you used to have?
Have you added an Ip such as 172.16.1.1 to your card so it is on both subnets, so you can ping/search for the old computer.
if you haven't then it will be trying to ping it via your default gateway.
0
 
LVL 21

Expert Comment

by:yo_bee
Comment Utility
Open notepad and paste the script in there.
Save as > ASCII File with a .vbs extension
Open Command Prompt.
type:   cscript File path and name of the vbs file
example:  cscript c:\PingComputers.vbs
0
 
LVL 24

Expert Comment

by:smckeown777
Comment Utility
Again my bad(not a good day)

Correct subnet mask is 255.240.0.0
This will mean you can scan the entire 172.16 - 172.31 subnet - and hence the scan should find what you are looking for...
0
 

Author Comment

by:jrsitman
Comment Utility
The problem is I'm access the server remotely so I can't get to the physical computer or I would run ipconfig /all as I noted in my post.
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 24

Accepted Solution

by:
smckeown777 earned 300 total points
Comment Utility
Yes but you don't need access to the remote computer...i meant ipconfig/all from your server you are on...

Reason your scanner isn't finding the rogue computer(at least my best guess) is that the subnet's are different - what is your existing subnet mask from the server for example?

If its 255.255.255.0 then you are only scanning the 172.18.1.x subnet
If its 255.255.0.0 then you are still only scanning the 172.18.x.x subnet - therefore can never see anything in the 172.16.x.x network...

So if you set the subnet mask to 255.240.0.0 this will allow your scanner to scan every IP in the 172.16.x.x - 172.31.x.x. subnets - and hence find your rogue pc...hope this helps.
0
 
LVL 1

Expert Comment

by:finfrockg
Comment Utility
"Sorry, make the subnet 255.0.0.0(not 255.255.0.0) to get the scan to work... -"

That won't work.  This lost computer will only respond based on its subnet mask.  If it was a /24 network, anything outside of that range of addresses, it will attempt to route to its default gateway.  
To find the computer - your best bet it to set your computer to the old default gateway address and run Wireshark on your computer, then you will capture any computer still using the old address scheme try to communicate beyond the local subnet.  A ping sweep would also good be a good choice.
0
 
LVL 57

Expert Comment

by:Mike Kline
Comment Utility
Have you tried using psexec from Microsoft, you can run commands against remote machines

http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx

From the help

This command executes IpConfig on the remote system with the /all switch, and displays the resulting output locally:

psexec \\marklap ipconfig /all


Nice script yo_bee - you should also post that to the TechNet script center

Thanks

Mike
0
 
LVL 24

Expert Comment

by:smckeown777
Comment Utility
'That won't work.  This lost computer will only respond based on its subnet mask.  If it was a /24 network, anything outside of that range of addresses, it will attempt to route to its default gateway. '

Good point @finfrockg - didn't think of that one...

Back to my original point - you need to change the server back to its original ip and re-run the scan to find this one...
0
 

Author Comment

by:jrsitman
Comment Utility
In my scan software I can't enter the full subnet.  See attached.
scan.jpg
0
 
LVL 24

Expert Comment

by:smckeown777
Comment Utility
Probably since the mask is 255.255.0.0 like I already said...with a mask of 255.255.0.0 it only allows you to change the last 2 octets of the address range...

But as @finfrockg mentions it probably makes no odds - as the remote machine will still have default GW set to the old 172.16.1.1 address(and thus not respond to anything...)

You said you know the machine name - any chance there's still a record for what IP it was using in your DNS records on the server?
0
 
LVL 25

Expert Comment

by:Fred Marshall
Comment Utility
Just to be clear re:
'That won't work.  This lost computer will only respond based on its subnet mask.  If it was a /24 network, anything outside of that range of addresses, it will attempt to route to its default gateway. '

The lost computer will respond to anything it receives if it's set up to respond to ICMP/Pings at all.  
- It *is* the destination and it will receive the packets.
- If suitably configured it should respond.
- If the source (and thus the response destination) IP address is on a subnet different from the target computer's subnet then it will still respond but the next hop will be its gateway on its local subnet.
- I the latter happens, the responding packets will still be "on the wire".
- If the sending computer is on the same wire (i.e. physical LAN) then it may well receive the responding packets.  Well, at least they will be present on the wire even if not in a form that would elicit an action by the pinging computer.

What I don't know is if the packets destined for the sending computer using the local gateway as the next hop will be seen by the sending computer anyway and not rely on the hop.  I *think* so but can't explain why right now .. so I have some doubt.  If the gateway has a broader subnet that includes both subnets then it will often bounce the packets back out onto the LAN.  But some don't.  The necessary experiments are easy to run.

I don't see in any of the responses that the pinging computer is on this, that or another subnet.  There is no ipconfig /all from the pinging computer as asked.  So we remain in the dark re: "is the pinging computer on the appropriate subnet at all?"
0
 

Author Closing Comment

by:jrsitman
Comment Utility
this worked.

Thanks for all the help
0
 
LVL 24

Expert Comment

by:smckeown777
Comment Utility
Good to know, glad you got sorted...
0

Featured Post

6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

Join & Write a Comment

Starting in Windows Server 2008, Microsoft introduced the Group Policy Central Store. This automatically replicating location allows IT administrators to have the latest and greatest Group Policy (GP) configuration settings available. Let’s expl…
Companies that have implemented Microsoft’s Active Directory need to ensure that the Active Directory is configured and operating properly. If there are issues found and not resolved, it eventually leads the components to fail or stop working and fi…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now