Hoss: Nice read if you run managed switches.... No bloody help to a poor sysadmin of a non-profit who wasn't able to afford managed switches when he built the infrastructure.......

With only regular switches or hubs locating a rogue machine is a major headache. I have had need to look for machines in the past and it's a peice of cake following them to the collision domain but at that point it kinda like being given a persons address and a map of the USA and told "fetch".....<LOL> If someone was hiding the box as they mentioned then trial and error is the order of the day.

Here's a brief description of the system I have used - walkie-talkies and an assistant really help save on shoe leather here......

Sit at any station and ping the offender. Go to your switch and disconnect a physical segment, (another switch/hub). Ping offender. If no reply then it is on the physical segment you pinged. If there is a reply then it is not. Plug back in the unplugged switch. Go to the switch that was connected to and unplug any hubs/switches plugged into it and ping until no reply. Move to that hub that doesn't reply. By now you should be at a switch that has only clients plugged in. Start disconnecting and pinging until no reply. On no reply trace the cable to the box. When box is found locate the owner and a funeral parlor.... The rest is self explanatory....