This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How can I track down a rogue ip on network?

I was looking at logs today and I see the following ip; 169.254.255.255

Now I think that i have my network completely mapped and do not know how to go about finding out what this device could be.

Included is the firewall line.

2012:10:04-06:10:07 ASTARO ulogd[4405]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" initf="eth2" outitf="eth1" srcmac="0:4:20:16:e1:e4" dstmac="68:5:ca:b:50:95" srcip="169.254.31.248" dstip="169.254.255.255" proto="17" length="96" tos="0x00" prec="0x00" ttl="126" srcport="137" dstport="137"

This thread was automatically locked due to age.

Parents

0 Scott_Klassen over 12 years ago

1)  The IP is an APIPA address.

2)  The device was connected through eth2.  If you have managed switches, you can narrow down the physical connection to a specific switch and port by looking at the address table.

3)  MAC address of 00:04:20:16:e1:e4.  MAC_Find: Vendor/Ethernet/Bluetooth MAC Address Lookup and Search.  There's a number of free or inexpensive MAC scanning tools out there, which can correlate MAC, IP, and NetBIOS name.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Scott_Klassen over 12 years ago

1)  The IP is an APIPA address.

2)  The device was connected through eth2.  If you have managed switches, you can narrow down the physical connection to a specific switch and port by looking at the address table.

3)  MAC address of 00:04:20:16:e1:e4.  MAC_Find: Vendor/Ethernet/Bluetooth MAC Address Lookup and Search.  There's a number of free or inexpensive MAC scanning tools out there, which can correlate MAC, IP, and NetBIOS name.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data