Re: rogue IP address

• Previous message: Stephen Entwisle: "SecurityFocus Article Announcment"
• Maybe in reply to: dondon_at_pacbell.net: "rogue IP address"
• Next in thread: Burton M. Strauss III: "RE: rogue IP address"
• Reply: Burton M. Strauss III: "RE: rogue IP address"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

To: jharris@rallycentral.us, security-basics@securityfocus.com
Date: Tue, 06 May 2003 00:00:19 +0000

Yea, if you have the MAC address you're money.

IF you have this, then you can start tracking down what type of NIC your
rogue IP is bound to ... and by deduction MAYBE even the box's hardware.

We used this trick once for a dup IP issue we had on a tier-one ISP's class
B network.

Here's how you do it:

1. Use this link to correlate the MAC address with a manufacturer:

http://www.coffer.com/mac_find/

The first three sets of numbers in the MAC address represent the vendor
code. At this site, do your search e.g. 00c095

MAC Address
   prefix Vendor
   00C095 Zynx Network Appliance box

2. Now match the type of NICs you use to the type of boxes you put them in
(this works best if your company hardware is running the rogue IP address).

Zynx is the brand of NICs we used in our Nokia firewalls. So in this case I
knew that issue was limited to a select number of firewall boxes and we
eventually fixed the dup IP issue.

You don't always get a cut and dry answer, but it does provide an extra step
you can use to troubleshoot.

The alternative may be to have your network guys trace the MAC address to a
*working* switch port. We know how long of a turnaround time that can be ;)

Of course, you need the MAC address here 8)

Erik

|On Thursday 01 May 2003 00:40, dondon@pacbell.net wrote:
|> Someone on our network assigned an IP address to their own system without
|> my knowledge. Using LANguard network scanner, the best I can tell is
that
|> it's a Linux box. The port-to-IP mapping table on our Asante switch
|> doesn't see to work correctly.
|>
|> Any suggestions on tracing down that system that is associated with the
IP
|> is appreciated!
|>
|> Andy

_________________________________________________________________
Protect your PC - get McAfee.com VirusScan Online
http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=3963

---------------------------------------------------------------------------
FastTrain has your solution for a great CISSP Boot Camp. The industry's most
recognized corporate security certification track, provides a comprehensive
prospectus based upon the core principle concepts of security. This ALL INCLUSIVE curriculum utilizes lectures, case studies and true hands-on utilization
of pertinent security tools. For a limited time you can enter for a chance
to win one of the latest technological innovations, the SEGWAY HT.
Log onto http://www.securityfocus.com/FastTrain-security-basics
----------------------------------------------------------------------------

• Previous message: Stephen Entwisle: "SecurityFocus Article Announcment"
• Maybe in reply to: dondon_at_pacbell.net: "rogue IP address"
• Next in thread: Burton M. Strauss III: "RE: rogue IP address"
• Reply: Burton M. Strauss III: "RE: rogue IP address"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]