DHCP Mystery (192.168.1.5)

[lost9999]

Hi, I am a new SysAdmin and I was overhauling the DHCP. Im having trouble finding out what computer is at (192.168.1.5) on my internal network. I pinged it and got a reply. Is there an easy way I can find out what computers are associated with which IP address? DHCP only shows me reservations and leases. Its not in either.

Help!

[cluberti]

If it's in DNS, you could do a ping -a 192.168.1.5. Otherwise, you'll want to use a network scanner to do some sniffing of the box to see what secrets it reveals.

[FAT64]

Could you not just use Remote Desktop and then right-click My Computer > Properties > Computer Name.

[rendrag]

Could you not just use Remote Desktop and then right-click My Computer > Properties > Computer Name.

that assumes it's a PC, and assumes it accepts remote desktop sessions.

[lost9999]

Could you not just use Remote Desktop and then right-click My Computer > Properties > Computer Name.

I loved this idea! It didnt work though... It may not be setup for remote (as stated in later post). The ping option didnt work either. I appreciate the options, anymore?

[lost9999]

Could you not just use Remote Desktop and then right-click My Computer > Properties > Computer Name.

that assumes it's a PC, and assumes it accepts remote desktop sessions.

Remote desktop did not work. I really loved that idea too! The ping suggestion didnt work either. We have over 100+ devices on the network so going from pc to pc doenst sound like a blast Any other suggestions?

[cheezewizz247]

Is there no Windows equivalent of the nmblookup you get on Linux, if not then a liveCD and going to a console and doing 'nmblookup -SA 192.168.1.5' may do it........

[cluberti]

There isn't an equivalent - nbtstat is very limited in Windows compared to nmblookup on *nix hosts. However, I still suggest a network scan of that IP to see what it reports, if anything.

[lost9999]

There isn't an equivalent - nbtstat is very limited in Windows compared to nmblookup on *nix hosts. However, I still suggest a network scan of that IP to see what it reports, if anything.

How do I do a network scan?

[Ponch]

Type the adress in a browser, you might get a page if it's a printer. Just an other idea.

[ringfinger]

Do a port scan and see whats open. Try to unc from the run line and look at the hidden c share if its a windows box. Is it in the same layer 2 network or is there a gateway between you? If L2, ping it, that'll add an arp entry to you're machine, issues the arp -a command to view the MAC, then use your network equip to find the device by MAC. If over L3, do a tracert and narrow down which hops it uses.

[cluberti]

How do I do a network scan?

When I'm stuck on a windows box to do these sorts of things, I like using this particular scanner.

[eyeball]

at cmd type nslookup

type set q=ptr

type 192.168.1.5

theres your answer hopefully

EDIT: sorry i overlooked the fact that a ping -a didnt resolve it. maybe try telnet to the IP?

Edited March 1, 2008 by eyeball

[cluberti]

at cmd type nslookup

type set q=ptr

type 192.168.1.5

theres your answer hopefully

ping -a does do a ptr lookup on the IP address. He stated that didn't work, hence 192.168.1.5 doesn't have a ptr (or a forward A) record.

[eyeball]

yeah i noticed u mentioned a ping - a after i posted, guess you saw my post before i edited lol