RE: How to find a changing IP on ethernet network

["Burton M. Strauss III" <BStrauss () acm org>]

Use the arp command.

open a c:\> (command) prompt and type

arp -a

This will show you the mapping between the lowest level address burned into
the adapter (called the MAC address) and the ip address:


C:\>arp -a

Interface: 192.168.xxx.xxx --- 0x2
  Internet Address      Physical Address      Type
  192.168.xxx.xxx       00-00-d1-xx-xx-xx     dynamic
  192.168.xxx.xxx       00-60-97-xx-xx-xx     dynamic
  192.168.xxx.xxx       00-60-08-xx-xx-xx     dynamic

If you do this a few times, you should see the same physical address
associated with multiple Internet Addresses.

If you have any kind of name resolution (WINS, DHCP, etc.) running you can
probably use the nslookup command

C:\>nslookup 192.168.xxx.xxx
Server:  xxx.xxx.xxx
Address:  192.168.xxx.xxx

Name:    yyy.yyy.yyy
Address:  192.168.yyy.yyy

To tell you what name (yyy.yyy.yyy) s/he is using.


If you don't have name resolution running, you can use net view:

C:\>net view \\192.168.yyy.yyy
Shared resources at \\192.168.yyy.yyy

Burton's desktop

Share name  Type   Used as  Comment

----------------------------------------------------------------------------
---
HP882C      Print           HP DeskJet 882C
SharedDocs  Disk
The command completed successfully.

That will usually give you a good clue.


-----Burton

> -----Original Message-----
> From: Ivan Andres Hernandez Puga
> [mailto:ivan.hernandez () globalsis com ar]
> Sent: Friday, February 20, 2004 8:54 AM
> To: security-basics () securityfocus com
> Subject: How to find a changing IP on ethernet network
>
>
> Hello. I have a client with a simple Ethernet network with HUB's
> connecting and there is one person that is changing it's IP and creating
> conflicts. What would you do to track down that person? i mean, to find
> who does that?
> Thanks!
> Ivan Hernandez
>
>
> ------------------------------------------------------------------
> ---------
> Free trial: Astaro Security Linux -- firewall with Spam/Virus Protection
>
> Protect your network with the comprehensive security solution that
> integrates six applications for ease of use and lower TCO.
>
> Firewall - Virus protection - Spam protection - URL blocking - VPN
> - Wireless security.
>
> Download 30-day evaluation at:
> http://www.securityfocus.com/sponsor/Astaro_security-basics_040219
> ------------------------------------------------------------------
> ----------


---------------------------------------------------------------------------
Free trial: Astaro Security Linux -- firewall with Spam/Virus Protection

Protect your network with the comprehensive security solution that
integrates six applications for ease of use and lower TCO.

Firewall - Virus protection - Spam protection - URL blocking - VPN
- Wireless security.

Download 30-day evaluation at:
http://www.securityfocus.com/sponsor/Astaro_security-basics_040219
----------------------------------------------------------------------------