Hidden IP in my network (kind of)

[isandu]

Hi, I'm new here.

At my workplace I am a software developer (I'm a software man, not a hardware one), but I have to monitor a network of 100 Windows XP PC's. A month ago I replaced an old router by a new one (ZyWALL 35), which is set to manage static IPs such as 10.10.x.y. Those IPs are listed by me and assigned as is necessary.

A week ago I discovered in the router Reports an IP (10.10.x.36), not assigned by me. This IP was downloading big, something like 600 MB in a few hours. This IP is seen only by the router, but the router sees no other information - the workgroup name, the user name or something else.

Other scanning software (LanHelper, MyLanViewer, Look@Lan) don't see the IP and, consequently, no other information on it.

PingPlotter says "Destination address unreachable".

So, my conclusion was that the PC is protecting himself, maybe using a firewall with a strong setting.

I was searching physically, office by office - I didn't see any external PC or notebook.

Is there a method to find out what is this station with the not-assigned-by-me IP?

TIA,

John

Edited April 2, 2009 by isandu

[dougiefresh]

Try blocking that MAC address and see who complains. It's not hi-tech, but if it is one of your company's machines, blocking that machine will ID the person doing the downloading because they won't be able to work. If not, you've just blocked a security risk.

[isandu]

Try blocking that MAC address and see who complains. It's not hi-tech, but if it is one of your company's machines, blocking that machine will ID the person doing the downloading because they won't be able to work. If not, you've just blocked a security risk.

I wish and I would do so, but I don't have the MAC address - the IP address it's all I see...

[amocanu]

Enable MAC address filtering in your router and build a list of allowed MAC addresses for all computers that connect to that router. This way only authorized machines will be able to access the it.

Edited April 2, 2009 by amocanu

[isandu]

Enable MAC address filtering in your router and build a list of allowed MAC addresses for all computers that connect to that router. This way only authorized machines will be able to access the it.

This is a nice solution, I'll try it as soon as I'll have a little bit of time.

amocanu, if you're Romanian write me a private message.

[GeneralMandible]

Try blocking that MAC address and see who complains. It's not hi-tech, but if it is one of your company's machines, blocking that machine will ID the person doing the downloading because they won't be able to work. If not, you've just blocked a security risk.

I wish and I would do so, but I don't have the MAC address - the IP address it's all I see...

If you're using a Windows machine and are in the same broadcast domain, open a command prompt and type the following:

ping 10.10.x.36
arp -a

You should see the IP with the corresponding MAC address.