Hi,

I have around 2-3 IPs on valid IP range which is a reserved pool of IP
given to us by our ISP. These IPs are live and pinging. We are sure
that we have not allocated any box with such IP address.

How can I find out which is that box which is using these IP? These IP
are live within the network because when we do a traceroute from
outside, it comes back within our network.

What is the way out? Is there any s/w available or do we have to do the
hard way of unplugging cables and finding out?

Thanks in advance

bandas

bandas@rediffmail.com wrote:

It probably depends somewhat on how big a LAN you're dealing with, what
you use for switching, and whether the rogue machines are deliberately
trying to hide or not (e.g. by spoofing).

With dumb switches, the simplest way might be to pick a quiet time and
start pinging the address of a rogue, then follow the blinking status
lights through your switch fabric. If you have wireless links, that
might not be possible.

Check any DHCP servers on your network to determine whether they've
made the allocation. And if you're doing DNS locally, that can be
queried, too.

arp might give a little additional information (e.g. manufacturer of
the interface or equipment involved).

Of course, you could also broadcast a request to your users and ask
them whether they've captured the addresses in question.

--
The e-mail address in our reply-to line is reversed in an attempt to
minimize spam. Our true address is of the form che...@prodigy.net.

Thanks a ton. The arp command worked. We could identify the device and
the box which is using these IP addresses.

Thanks once again for the suggestion

bandas