Find an unknown static IP + subnet mask of device?

Question

I have a device set with a static IP and subnet mask. I do not know the IP or subnet mask. How can I find the devices IP and subnet mask?

It is a piece of hardware, not a PC. It will not take an IP from DHCP. I have also tried directly plugging in a LAN cable from my PC to the device with Wireshark running to see if I could capture any packets from the device when it starts or has an Ethernet cable plugged in to it – but there appears to be nothing.

The device appears to be working as it flashes on the Ethernet ports.

Is there any software to do pingsweeps across IPs and networks?

Answer 1

3 steps

1. Download, install and start wireshark
2. Connect the device to the computer with the cable
3. Restart the device (unplug and plug it back to the power line)

In case the device has a static IP, it should(might) broadcast it's IP on the network, which you should detect with the wireshark.

In case the device has dynamic IP set up, it will ask for an IP adress, in which case connecting it to a router or a computer with DHCP server will resolve the issue.

Note, just today I've seen the sys admin use these steps to find out an unknown IP from the device :)

Answer 2

You could try Angry IP Scanner or, if you have a Linux server, use arp-scan.

Answer 3

I recommend netdiscover. You can use it in passive listening mode and detect incoming ARP announcements (using the -p switch) , or just apply some brute force:

netdiscover -S -f -i eth0

Note that this is incredibly fast compared to nmap (maybe I did not tune nmap well enough).

Also that the method suggested in the currently accepted answer (sniffing for ARP announcements using Wireshark) essentially is what the -p mode is doing.

Answer 4

Try this command, it will ping all possible broadcast addresses.

ping 255.255.255.255

Answer 5

Assuming that it is plugged into a managed switch, find the switch that it is plugged into, and track it down to the specific port. Log into the switch, and look at the mac-address that is associated with that port. In Cisco land, it would be something along the lines of show mac-address-table | i 5/34 where 5/34 is the port that the device is plugged into.

Once you have the mac address of the device, then you can look at the arp tables on the switch, which should show you an IP. Again, in Cisco, it would be something like sh arp | i FFFF where FFFF is the last 4 characters of the device's mac address.

That will get you as far as the IP address. The you should be able to use a tool like wireshark to watch the traffic, and glean the netmask from the traffic.

Answer 6

this has helped me a few times on Windows.

arp -a

This displays the networks neighbour cache. Its a local cache of IP/MAC address resolutions. Useful to identify new devices that have joined a network and duplicate static IPs.

Answer 7

In OSes that don't let you ping the all-ones broadcast address (255.255.255.255), you can usually still ping the "All Hosts" multicast address:

ping 224.0.0.1

All IP stacks for two decades have supported multicast, so they should all respond to that, unless they have an overzealous firewall.

Answer 8

I had success on my Linux box using a USB-Ethernet adapter (like this one), and issuing:

$ ping -I eth2 -b 255.255.255.255

Answer 9

Use nmap:

Nmap ("Network Mapper") is a free and open source (license) utility for network exploration or security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and official binary packages are available for Linux, Windows, and Mac OS X. In addition to the classic command-line Nmap executable, the Nmap suite includes an advanced GUI and results viewer (Zenmap), a flexible data transfer, redirection, and debugging tool (Ncat), a utility for comparing scan results (Ndiff), and a packet generation and response analysis tool (Nping).