Finding an IP?

What software product can I use to scan a wireless or wired network device in order to get it's unknown IP address. Basically I'm looking for a product that can pull not only the MAC but find/request (or beat) the applicable IP from an unknown IP addressed device.

Follow me on this:

a) There is no access to the web to download the manufacturers manual prior to or during the work. (and probably wouldn't be if the device is a gazillion years old)
b) There is no one that I can call to have them look on the web while I'm working.
c) There is no access to the web based configuration since I don't have the IP.
d) The client has no product manual available.
e) SNMP scans are powerless.
f) Factory resetting the device isn't an option since I still don't know the default IP and a normal scan of standard configurations don't work. (depends on the item in question, of course).
g) The device is not responding to manual IP subnet scans of the usual IP configurations normally seen in a network.
h) Banging the object against a desk only works partially.. :-)
-------------------------------------------------------------
Normally I use a variety of methods and tools to get what I'm needing, but in some occasions they just leave me hanging.

Oh... and I'm still looking for that magical software that allows me to be on, say 192.168.2.x and scan for IP's on any OTHER unknown subnet without forcing me to change my IP configuration.
(no VPN's are included in this scenario, as they DO allow that kind of behaviour)

Thanks.

Don't know if this would help or not. . . but I use GFI LanGuard Network Scanner May be of some help. Hope so.

how sure are you that the item has an actual IP address...some network equipment has no IP (like modems, they dont have an IP usually, but the computer attached does)

try to use numerous "stealth scans" aviable in nmap ... (xmas, fin, etc...)

Thanks for the responses so far, (no solutions yet)

Languard is a security scanner (meant to be use for revealing internal security risks, not an IP interrogator.) It doesn't have the capability. Thanks though!

XTC46, yes the items in question would have an IP. (for sure).

Unhappy, Nmap stealth scans are meant to find the presence of devices WITHOUT causing a full TCP handshake, thereby not disturbing possible watching IDS/Firewall device/software.
Unless a newer Nmap has the features I'm looking for. Guess I will have to download it again to find out. Last time I installed Nmap, I found my windows based scanning software suite had the same features, so I dumped Nmap.

Well. . . LanGuard has many other "uses" other than just looking for security holes. But . . . ok. :) Hope ya find something that helps.

I have a older version of LAN GUARD it it shows, machine name, MAC address, IP address, protocols installed, etc ....and security issues. :eek:

I find it handy when documenting networks...etc


MLF

And if someone is currently logged into a network you scan it will aslo list their login name. lol

Can you take the device off of its current network segment? Place it on a hub with only your sniffer attached to it. Then just wait for some type of traffic or broadcast? Then you can get ip or mac? Possibly more info?

I'm assuming that you have physical access to it because you say banging it on a desk....

Maybe just plug that device into a hub then back to the switch.
Then you can watch all traffic going to that device. That will surely show you IP and MAC.

You can use ettercap to scan the subnet using arp. Then that box should reply with its IP address... But... if you don't know WHICH subnet... then you're SOL. Which is what you want. So.. that won't work.

I think putting a hub between that and other hosts and sniffing the traffic would be the best way.

Have you seen this:
AirSnare
http://home.comcast.net/~jay.deboer/airsnare/

Sorry only MAC info..

TCPNet View is not too bad --
http://gorlach.etype.net/netview/index-e.html

What kind or device is this? Router? Switch? What? What's it's purpose on the network? Is it actually functional or is it "dead" equipment that never got removed? What are the subnets you do know?

That might help in determining an "attack" vector....

Quote:

---

That might help in determining an "attack" vector....

---

I know... I feel like we're playing "go fish"...

Quote:

---

Originally posted here by phishphreek80
Can you take the device off of its current network segment? Place it on a hub with only your sniffer attached to it. Then just wait for some type of traffic or broadcast? Then you can get ip or mac? Possibly more info?

I'm assuming that you have physical access to it because you say banging it on a desk....

Maybe just plug that device into a hub then back to the switch.
Then you can watch all traffic going to that device. That will surely show you IP and MAC.

You can use ettercap to scan the subnet using arp. Then that box should reply with its IP address... But... if you don't know WHICH subnet... then you're SOL. Which is what you want. So.. that won't work.

I think putting a hub between that and other hosts and sniffing the traffic would be the best way.

---

The device is off the network segment and I am plugged into it (a wireless IP router by the way) and can sniff raw data using ethereal but all I get (and the only thing I get) is multiple spanning tree algorithm packets with no IP in the header or data fields. I did the ethereal sniffing at client site, now the box is at my office. (havent had time to look at it yet, but soon I will)
It's not responding to arp packets and I have no assurance of it's IP as it's not responding to IP scans.

banging it on a desk was merely a last resort joke, as in "hit it with a bigger hammer."

Still, I'm still looking for that magical software that allows me to be on, say 192.168.2.x and scan for IP's (or MAC's) on any OTHER unknown subnet range without forcing me to change my IP configuration.

Robakam, I have and use Airsnare, but it's just a basic logger.
I will look into tcpnetview to see if it's better than my other network scanning software.

TS, It's a wireless router, as you already know. It was functional for over a year before I got the call to come find out why network access off this device is not working.

Quote:

---

What are the subnets you do know?

---

It was on a 192.168.1.0 subnet.

Actually there are two wireless routers with this problem, although the "one' router resolved itself after a 45 minute poweroff rest and has been working in my office overnight. The "other" router I will look into after I come back from an appointment with a client.

Well if there is No info on the net...no vendor support..you dont have manuals...why would you want the device on your network???

Toss it!

Buy a new one??

...maybe I am not understanding the point here :confused:


MLF

I'm inclined to agree with Morgan....

This device seems to be totally non-standard and, depending upon the frequencies used may actually not be FCC approved any more and thus might cause other trouble. If you know the task these two devices were intended to perform is it possible to substitute them for something more *cough* mainstream"?

Quote:

---

banging it on a desk was merely a last resort joke, as in "hit it with a bigger hammer."

---

I know it was a joke. ;) But from that joke I guessed that you had physical access to the device.

Quote:

---

Still, I'm still looking for that magical software that allows me to be on, say 192.168.2.x and scan for IP's (or MAC's) on any OTHER unknown subnet range without forcing me to change my IP configuration.

---

I'm unable to find software that will do this too. I'd think that it'd take WAY too long to scan all unknown subnets... Not only that... but now you'd be possibly scanning out onto the internet and other people's networks and not your own. If someone didn't know what they are doing and did this... there would be a lot of pissed off network/firewall admins out there.

I even tried setting my ip to dhcp so no ip was assigned. Then I unbind IP from my network interface. The tool I tested with was ettercap. It pulled my last known IP address and scanned that subnet.

I rebooted and it saw that my ip was 0.0.0.0 with a subnet of 255.0.0.0 and it wouldn't scan anything. Ethereal showed no traffic being generated from ettercap.

Thanks Phishy for trying it using ettercap without a bound IP on your adapter.

In answer to your other question Phishy, the software I'm looking for won't need to scan ALL unknown subnets, just a user selectable range of private IP addresses on a device I suspect is NOT addressed properly while on the same physical wire. I know this goes against the RFC but it would allow any addressed IP host machine to find ALL client IP machines regardless if they are properly addressed.

Sample fictional scenario:

I walk into an unknown network, as usual. The client complains that a program on their network is not working at all, since last night. I examine the program finding a client application that can't find it's server counterpart. Also there is a mapped drive that no longer exists. Instead of examining server share rights, logon names, proper syntax, proper shortcut redirection, blah....blah...blah, I notice a router between the client and the server, and a brief glance shows the router lights seem to be working.

The first option, after talking to those people involved, is to grab it's IP and get into the routers configuration page. So out comes the network cabling while I aim my overpowered notebook towards the proper network settings and give it a scan.
A IP scan of the network shows 6 working devices, but no router. A MAC scan gives 6 working devices, but nothing resembling a router.

Look at the router and ...Oh..it's one of those new ones or obscure ones or one that I have no current documentation on. All faceplate lights on the router blink in a bootup sequence that would show proper self check and subsequent operation but don't blink when data is being routed.
Repowering the router (over and over) doesn't do anything different.

I can take a chance at factory resetting the device, but some devices can only be reset while holding the reset button in when powering on, or it could be hold the reset button in for 15 seconds, then power off...or it could be....blah...blah..blah.. Make the wrong move and you can eat a router and I'm not that hungry.

What I need about now is a multi-threaded program that can scan all user defined IP addresses, even outside the current subnet range. Even if the router gave a MAC address I still don't have an IP address to telnet or http: into.
I don't want to spend 45 minutes scanning 10.0.1.x, 10.0.2.x, 10.0.3.x, and/or 172.16.0.x, 17.16.1.x (and I haven't even got close to 192.168.x.x, which is where I'd start first anyways, depending on the size of the network), etc...etc...

So here's the bottom line in this scenario:

Seems an inhouse network guy, who is off today, had a perceived router problem last night and factory reset the router using proper reset procedure for that router. But since he was off today, he left the clean up job (resetting up the router parameters) to his compadres on the morning shift (course he won't admit to that). So router was on a 192.168.x.x subnet but since the factory reset reverted to a 10.15.2.x (whatever!). It's now my job to find out why the application doesn't work, but instead I see the bigger problem. Using a scanner I want to find the IP address without spending ALL day long. Sure I make more money to a point, at which point the client starts seriously deciding on calling someone else and I lose the client forever.

Hopefully this is clear now and you can re-read my original post for the details.

This may work for you.

Correct me if I'm wrong but doesn't ethereal in promiscuous mode show all packet regardless of subnet? In that case, hook up your laptop with a cross-over cable directly to the rj-45 port of the router and then power cycle it. When it comes on it will most likely send out some packets onto the network and you'll be able to catch those.

zENGER,

Quote:

---

The device is off the network segment and I am plugged into it (a wireless IP router by the way) and can sniff raw data using ethereal but all I get (and the only thing I get) is multiple spanning tree algorithm packets with no IP in the header or data fields. I did the ethereal sniffing at client site, now the box is at my office.

---

I seriously don't want to scare people off of helping, since my last post said "sample fictional scenario". I actually have a copy of that sample fictional scenario device in my office right now.
Since I'm a roving Consultant, I seem to get the sh** jobs no one else can figure out. Lucky me! (actually I love it).

Soon I'm going to startup the wireless router again and see what ethereal shows. After putzing with it a bit, I'm going to offer Gore or Tigershark or anyone else close enough to my location a few get acquainted beers and let them play with it, just for kicks.

What if you were to bring in another router... say a Cisco and add those networks/subnets. The 800 series are inexpensive ($250-500) and you can have multiple networks connected to it since it has multiple ethernet interfaces. (I use a 831 broadband router and a 806... 831 is the better of the two.)

Then you can route your scan through the router. Then you don't have to reconfigure the interface of the machine you're scanning from. Only the router config. ;)

You could also use another laptop if you wanted to... just configured like a router.
But... you are limited on interfaces and the laptop will cost more than the 800 series Cisco.

I know this isn't want you want... but I'm thinking up ideas.

BTW: How "Northeast" are ya? I'm right in the middle... close to Philly.

BTW: Have you ever tried out the solarwinds engineer edition. IIRC, you can tell what subnets you want to scan... but you have to have a route. Great suite of toolz. Expensive... but great. Let me know if you like them... I may have something else for you. ;)

http://www.solarwinds.net/Tools/Engineer/

This might not be what you are looking for exactly but I have been impressed with what I have read about it's speed and the elegance of the "solution". On a small network not connected to any other network you might get a response quicker than any other means

Scanrand

If it doesn't perform as advertised I'd like some feedback.