Advertisement
If you have a new account but are having problems posting or verifying your account, please email us on hello@boards.ie for help. Thanks :)
Hello all! Please ensure that you are posting a new thread or question in the appropriate forum. The Feedback forum is overwhelmed with questions that are having to be moved elsewhere. If you need help to verify your account contact hello@boards.ie

Locating a system by MAC address on a win2k Domain

Options
  • 18-05-2005 11:40am
    #1
    dathiultaigh
    Closed Accounts Posts: 140 ✭✭


    Hi all,

    was wondering could you help me. I wish to locate a system on a WIn2k domain by searching with the MAC address only (I dont wish to scan a range of IP addresses on the network in order to recieve their corresponding MAC addreses). Would any 1 know of any tools or commands to locate a workstation just by MAC address on a network?

    Thanks


Comments

  • Options
    #2
    Gavin
    Registered Users Posts: 4,676 ✭✭✭Gavin


    Define 'locate'


  • Options
    #3
    dathiultaigh
    Closed Accounts Posts: 140 ✭✭dathiultaigh


    basically is the system on the network so I can locate it - heres the scenario - the system went missing from a certain dept. The machine name is not present on a particular domain so I wish to locate the system on the network by MAC address as It may have been formatted.

    obviously there are lots of different ways I can chase this up internally but I would rather try to see if the system is on the network somewhere before i try this.Also I dont wish to use a network sniffer.

    thx


  • Options
    #4
    CapatalisimCod
    Closed Accounts Posts: 29 ✭CapatalisimCod


    Try arp-a from cmd prompt, should give you a list of all computers that are using arp, will map ip address to mac


  • Options
    #5
    Capt'n Midnight
    Moderators, Recreation & Hobbies Moderators, Science, Health & Environment Moderators, Technology & Internet Moderators Posts: 91,877 Mod ✭✭✭✭Capt'n Midnight


    Do you use DHCP ?
    check against your DHCP server
    www.microsoft.com/windows2000/techinfo/reskit/tools/new/dhcpexim-o.asp

    if not then ping 192.168.x.255 (broadcast) and then do an ARP -a
    to try to locate the mac, or use a util like ipscan14.exe (not a sniffer)

    of course firewalls like XP SP2 or it being on a different subnet won't help

    or go to the server it is likley to connect to - or check the internet firewall for MAC lists there.


  • Options
    #6
    Rew
    Moderators, Sports Moderators Posts: 8,679 Mod ✭✭✭✭Rew


    Do you have managed switches? If so look up the MAC address table's for the ports, find out where the port with the MAC is pathced to and Roberts your mothers brother...


  • Advertisement
  • Options
    #7
    BobTheBeat
    Registered Users Posts: 1,048 ✭✭✭BobTheBeat


    Bite the bullet and install ethereal. Sniff around for a day or so, something will turn up eventually. Unless you work in a fairly well internally secured network, or with a paranoid admin (:p), you should get away with it.


  • Options
    #8
    JohnnyMobile
    Closed Accounts Posts: 463 ✭✭JohnnyMobile


    bobmeaney wrote:
    Bite the bullet and install ethereal. Sniff around for a day or so, something will turn up eventually. Unless you work in a fairly well internally secured network, or with a paranoid admin (:p), you should get away with it.
    Thats what I would do just filter by MAC address and if its there you should find it.

    Also as mentioned above... if you have managed switches it would be handy enough to find it... although rather then checking the MAC table I would ban the MAC and wait for the user to call up with no net access :)


  • Options
    #9
    Kali
    Closed Accounts Posts: 6,601 ✭✭✭Kali


    Try arp-a from cmd prompt, should give you a list of all computers that are using arp, will map ip address to mac

    Won't give usable results on a workstation... maybe a PDC, but even then theres a timeout for the arp table.

    Best bet is Rews advice.. get a network admin to check one of the core switch's mac address table (show mac-address-table).. then narrow it down from there.

    Ethereal is no good if the interface is connected to a different broadcast domain... otherwise a filter would work well.


Advertisement