i know the MAC addy, but need to get the IP address

[big daddy fatsacks]

i recently took over for a guy as IT manager of a small office. he has dell 3048 and 5012 switches running (plus some old 3Com hubs ) he left the password for the 5012, but not the 3048. come to find out the IP address he left for the 3048 is not valid either. i cannot connect to this thing at the moment.

i DO know the MAC address for it though. is there any way to resolve the MAC addy to IP addy?

 

[oakfan52]

port scan the subnet? try LANguard Network Security Scanner

 

[big daddy fatsacks]

i'm using look@lan right now, but i'll check that other one out. thanks.

 

[mitch808]

Just console into the darn thing.

 

[senorpyro]

does it have a serial port? if so just bring a serial cable and telnet straight into it.

 

[Zwitterion]

isn't that what arp is supposed to do?

 

[BobSutan]

Originally posted by Zwitterion
isn't that what arp is supposed to do?

No. You mean Reverse ARP (BootP & DHCP are essentially RARP protocols in that they shell out a hardware address in return for a logical one).

http://tinyurl.com/2nke9

 

[skritch]

You can just look at the ARP cache.

 

[Zwitterion]

Originally posted by BobSutan
No. You mean Reverse ARP (BootP & DHCP are essentially RARP protocols in that they shell out a hardware address in return for a logical one).

http://tinyurl.com/2nke9

Oh, thanks for the explanation. I knew it was along those lines.

 

[big daddy fatsacks]

it wasn't in the arp cache. that was the first place i looked although i was under the same mistaken impression as zwitterion till i tried using it a bit.

anyway . . . .

 

[skritch]

Originally posted by big daddy fatsacks
it wasn't in the arp cache. that was the first place i looked although i was under the same mistaken impression as zwitterion till i tried using it a bit.

anyway . . . .

There'd need to be recent activity between the machine whose ARP cache you're checking, and the system in question, for the address to be present. ARP cache entries time out rather quickly with a lack of sustained activity, and are removed from the cache.

You can force this activity to occur by pinging the broadcast address for the subnet. Check the ARP cache after doing this, and it'll be there.

 

[Gertrude]

Edit:

Never mind misread something..

Anyway.. If there is a *nix computer on the network you could try to use arping..

http://freshmeat.net/projects/arping/?topic_id=150