Home page logo

basics logo Security Basics mailing list archives

Re: Identifying a computer
From: "Tim Willard" <twillard () thewillards net>
Date: Wed, 3 Dec 2003 14:16:49 -0800 (PST)

1) Sniff the traffic and get the mac address
2) Look up the mac on your switch and find out what port it is on
3) disable the port or go yank it out of the wall.



I am helping the sysadmin on my local LAN to manage the network, etc. We
have limited internet-bandwidth, and therefore it is necessary to make
sure no-one
is taking to much of the bandwidth, as others will not be able to use
the internet connection.

For the last 2 days, a new IP has appeared, and it is constantly using a
lot of bandwidth.
We have a linux-server running DHCP, DNS and the internet-connection. I
have checked the
dhcpd.leases file, but the IP isn't there. I have also tried to ping and
scan this IP, but the computer
is running a strong firewall, shows no open ports and doesn't even
respond to pings.

Is there any way I can get some information out of this computer without
running around
and asking everyone what their IP is?




  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]