Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm in a strange situation... A customer has a huge network based on static ip. All machine names are not useful to identify a computer location and network switches are not managed.

One of the computers on the network started broadcasting like crazy hogging their astaro security gateway cpu (probably virus).

I've been able to cut the problem down setting a rule on the astaro to drop all the request from the problematic ip.

Now I need to find out where that pc is.

I thought that if I'm able to shut down its network services the user will call me for assistance and then I'll be able to find the pc and discover what appened.

How can I obtain that?

Sounds like a ddos attack in "my" network, right?

I have no access to that pc because everyone's admin of his own pc with his own password so no dameware working, no remote desktop, no mmc snap in, no regedit.

any hint?

share|improve this question
    
Thanks for a not discussed downvoting: appreciate it. –  Pitto Aug 12 '13 at 10:21

4 Answers 4

up vote 5 down vote accepted

You've got the MAC address so assuming these are brand name machines rather than generics you should be able to track down the manufacturer ( http://www.coffer.com/mac_find/ ), that may narrow you search slightly (assuming you don't have all Dell or similar).

You can use the IP address and a port scanner like nmap to finger print the host and find the likely OS it's running, perhaps narrowing it down further.

If the host is running Windows it will display an error if it detects an IP conflict on the network - I'd suggest intentionally causing an IP conflict and using that method to flag up an alert on the screen of likely candidates.

share|improve this answer
1  
+1 Triggering an IP conflict is a good idea. –  egorgry Mar 18 '11 at 12:24
    
so easy, so functional :) Windows 7 didn't cause the conflict but sweet old windows xp did the job. Very well done, mate. –  Pitto Mar 18 '11 at 12:37

If you have unmanaged switches your options are limited but you can always try the disconnect/reconnect trick for your segments. If done logically you should be able to track down the machine pretty quickly and disconnect it, this will get its owners attention.

share|improve this answer
    
Much too switches and much too users involved... I can't wreck the network just to find out where this damn pc is :( I'd really like more to flood this single pc and kill its nic but I can't find how :( –  Pitto Mar 18 '11 at 11:11
    
You've got the ip address. From there you can get the MAC address and hopefully the host name. Is there no documentation of which user is assigned which computer or which computer has which ip address? In addition, by following Chopper3's suggestion you're not "wrecking" the network, you're temporarily disabling some of it's segments. In addition to that, the fact that everyone is a local admin doesn't preclude you from accessing their computer if you're also an admin. It sounds to me like you're going to have to walk around to each computer to find the problem one. –  joeqwerty Mar 18 '11 at 11:18
    
I have MAC address and hostname but the hostname's clueless... This network's really bad (300 clients) with each one (more or less) different admin password. I'm ready to get in every room and check but if I can find a tool to flood that pc I can solve in minutes. –  Pitto Mar 18 '11 at 11:30

If the switches have SNMP you may be able to find the PC by observing the counters. No guarantee of course but worth a shot.

If that doesn't work it looks to me like you're most likely going to have to resort to some old fashioned tracking. This sort of thing used to be done by unplugging cables until the culprit was found. While that may sound excessively brutal it's part of the price to be paid for such an appallingly set up network.

share|improve this answer

If you have managed switches, you are able to trace the MAC involved and shut down the port - and then just wait for the angry user complaining about the network being down...

tsg

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.