A Simple IP Question

Ok, I've got a very basic question, just need to know what command I'm looking for.

I've got a new network monitoring program and I'm trying to figure out which IP addresses it shows belongs to which machines in this building. I have them all identified except for a few, and those few I have no idea for the life of me who the addresses belong to.

So what I want to do is use the IP address to find the host name. I know this is a basic thing, so I just need to remember what the command to use is. I'm used to pinging the host name to find the IP, so I'm just trying to figure out how to do vice-versa.

nslookup? Probably not..

nbtstat -a <ip-address> works wonders on windows too.

If these machines get a DHCP address you might want to check the leases too.

Dunno.. just shooting in the dark :D

Hi AngelicKnight

I am not sure what exactly you mean:

First idea: NetBIOS hostname

Code:

---

> nbtstat -A 192.168.1.65

---

Second idea: Reverse lookup (if, if and if). For example
(...you get the idea):

Code:

---

> nslookup
> set type=ptr
> 65.1.168.192.in-addr.arpa

---

Also shooting in the dark :)

Cheers.

Even easier guys:-

ping -a 192.168.1.1

the -a = address resolution

Thanks guys, that did it!

Ok, now I have this one address that I'm seeing on the network but I have no idea who it belongs to. The LAN IP is 192.168.1.245. Now check this out:

C:\Documents and Settings\Administrator>ping -a 192.168.1.245

Pinging 192.168.1.245 with 32 bytes of data:

Reply from 192.168.1.245: bytes=32 time<10ms TTL=128
Reply from 192.168.1.245: bytes=32 time<10ms TTL=128
Reply from 192.168.1.245: bytes=32 time<10ms TTL=128
Reply from 192.168.1.245: bytes=32 time<10ms TTL=128

Ping statistics for 192.168.1.245:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

C:\Documents and Settings\Administrator>nbtstat -A 192.168.1.245

Local Area Connection 2:
Node IpAddress: [192.168.1.34] Scope Id: []

Host not found.

Didn't tell me anything, but the software for the new managed switch we're running shows the address as very much being there and active.

Quote:

---

Originally posted here by Tiger Shark
Even easier guys:-

ping -a 192.168.1.1

the -a = address resolution

---

Hehe I kinda assumed anyone with 1500+ posts would do a ping /? or man ping ;)



AngelicKnight: Do these machines get their addresses from dhcp? You might want to check that. clients usually register their hostname at the dhcp server.

Quote:

---

Hehe I kinda assumed anyone with 1500+ posts would do a ping /? or man ping

---

Shhh...I was just...um...testing you guys...yeah...that's it...

Yes, they do get it from DHCP. But the wierd thing is that in DHCP on my domain controller, these addresses don't show up. Nor do they in DNS.

Ah. Maybe a rogue machine?

How about disabling the switchport?

Vary the subnet to exclude the 254, and see who comes calling :)

192.168.1.245
255.255.255.244 ?

I'm just studying this NOW ......
and it is HURTING :toothache:
I'm assuming a subnet of 255.255.255.0 ?
So the new one would only allow the first 244 connections ?

flame away :)

Angelic:

Quote:

---

Yes, they do get it from DHCP. But the wierd thing is that in DHCP on my domain controller, these addresses don't show up. Nor do they in DNS.

---

Sorry.... But just because your domain policy allows for DHCP doesn't mean that I can't connect to your network with a valid IP address... I just need to find an unused one to avoid those pesky "There has been an IP Address conflict" messages.

Check your reservations in case it's that JetDirect printer you put in a year ago or something similar. Then it's time to break out the Ethereal Tutorial, run it and see what you can see.....

Nmap scan it. You can usually tell what it is by the open ports. It listens to pings so chances are it'll scan nice and quick. If it doesn't scan nice and quick... hmmm...

You should know where your switches are. If they're managed you should be able to find out which port this machine is attached to. After that it's just a matter of following the cable :)

Oh! And bring a lart ;)

lart's explained

LART's - because STUPID HURTS

:rofl: heard it, but never really knew WHAT it was ................. Google IS your friend

Quote:

---

If they're managed you should be able to find out which port this machine is attached to. After that it's just a matter of following the cable

---

Oh, duh. And here I am again trying to swat a fly with a rocket launcher. As a good sounding excuse for myself though, this is the first time I've used a managed port, so I'm not used to thinking about this feature. :D

Turns out the two devices that were giving those IPs was a VPN unit and a BocaVision terminal. Mystery solved!

I must be spoiled :D The only unmanaged one I ever use is the one at home :rolleyes: