Re: how to find out unknown machine IP ?

From: Tony 'Nicoya' Mantler (nicoya_at_ubb.ca)
Date: 11/24/05

  • Next message: Frenchie: "Re: Hard disk die on my silicon?"
    Date: Thu, 24 Nov 2005 03:05:20 GMT
    
    

    In article <dm2lce$jp2$02$1@news.t-online.com>,
     Walther Mathieu <mathieu.nospam@in4tec.de> wrote:

    : Hello,
    :
    : I know this canīt be too complicated... but I donīt remember:
    : How can I find out the IP number of a totally unknown machine?
    :
    : I got me two SGI servers from the local university recently
    : (they would have dumped them otherwise I fear) and both run fine.
    :
    : (Its a Challenge M and a Origin 200, plastic enclosures worn)
    :
    : No head on any of them (just servers) - now I have them connected
    : to my little SOHO SGI network here, but before I can administer:
    :
    : How do access these?
    :
    : Are there utilities within (reach of) IRIX to find out its IP?
    : Port scan or something - where to find?

    If you have no console access to the systems, you can use a different system and
    try some of the following:

    If you know what subnet the mystery systems are on, set your known system to an
    address on that subnet and do a broadcast ping.

    For example:

    $ ping -b 192.168.1.255
    WARNING: pinging broadcast address
    PING 192.168.1.255 (192.168.1.255) 56(84) bytes of data.
    64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.236 ms
    64 bytes from 192.168.1.250: icmp_seq=1 ttl=255 time=0.449 ms (DUP!)
    64 bytes from 192.168.1.3: icmp_seq=1 ttl=64 time=0.573 ms (DUP!)

    --- 192.168.1.255 ping statistics ---
    1 packets transmitted, 1 received, +2 duplicates, 0% packet loss, time 0ms
    rtt min/avg/max/mdev = 0.236/0.419/0.573/0.140 ms

    Not all systems will respond to a broadcast ping, though. SGIs generally will.

    If you have no idea what subnet the machine is on, you can watch for ARP traffic
    when the system brings up the interface using tcpdump or tethereal.

    For example:

    # tcpdump -n -i eth1 arp
    tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
    listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
    20:58:53.692369 arp who-has 192.168.1.2 tell 192.168.1.2
    20:58:54.173818 arp who-has 192.168.1.2 tell 192.168.1.2
    20:58:55.175310 arp who-has 192.168.1.2 tell 192.168.1.2

    3 packets captured
    6 packets received by filter
    0 packets dropped by kernel

    # tethereal -n -i eth1 arp
    Capturing on eth1
      0.000000 xx:xx:xx:xx:xx:xx -> ff:ff:ff:ff:ff:ff ARP Who has 192.168.1.2?
    Gratuitous ARP
      0.300824 xx:xx:xx:xx:xx:xx -> ff:ff:ff:ff:ff:ff ARP Who has 192.168.1.2?
    Gratuitous ARP
      1.302485 xx:xx:xx:xx:xx:xx -> ff:ff:ff:ff:ff:ff ARP Who has 192.168.1.2?
    Gratuitous ARP

    Most systems should send out a few ARP requests like these when they connect to
    the network.

    Of course, the best solution would just be to wire up a console cable. You'll
    need one eventually.

    Cheers - Tony 'Nicoya' Mantler :)

    -- 
    Tony 'Nicoya' Mantler -- Master of Code-fu -- nicoya@ubb.ca
    --  http://nicoya.feline.pp.se/  --  http://www.ubb.ca/  --
    

  • Next message: Frenchie: "Re: Hard disk die on my silicon?"

    Relevant Pages

    • Re: Machines on LAN
      ... to give to find the devices on my lan. ... ARP tables. ... broadcast ping, ...
      (comp.os.linux.networking)
    • Re: arp table - Newbie
      ... The server was not able to connect to the network. ... When arp -a re-issued, ... Entries in the arp cache time-out so before ... or possibly transmitting a "broadcast ping". ...
      (comp.unix.solaris)
    • Re: How to get all arp entries for a certain network
      ... Ping the broadcast, but don't do this very much, as it can ... Some hosts will not respond to a broadcast ping, ... Some hosts have firewalls configured to block/ignore pings. ... looking for ARP request/reply packets. ...
      (comp.os.linux.networking)
    • Re: How to get all arp entries for a certain network
      ... Zahi Shahak wrote: ... > How can I get my arp table to fill up with all the objects in a ... > certain network(which I have the network/netmask). ... You can do a broadcast ping, ...
      (comp.os.linux.networking)
    • Re: False negative on anti sniffing programme.
      ... >> folowed the approach of sending arp request packets to the IP of the ... >> responding to these packets despite not being in promiscuous mode. ... sniffers, we can't help you, cos you really can't do anything worthwhile". ...
      (Security-Basics)