0

I'm in a strange situation... A customer has a huge network based on static IPs.

All machine names are not useful to identify a computer location and network switches are not managed.

One of the computers on the network started broadcasting like crazy hogging their astaro security gateway CPU (probably virus).

I've been able to cut the problem down setting a rule on the astaro to drop all the request from the problematic IP.

Now I need to find out where that PC is.

I thought that if I'm able to shut down its network services the user will call me for assistance and then I'll be able to find the PC and discover what happened.

How can I obtain that?

Sounds like a DDoS attack in "my" network, right?

I have no access to that PC because everyone's admin of his own PC with his own password so no Dameware working, no remote desktop, no mmc snap in, no regedit.

0

4 Answers 4

8

You've got the MAC address so assuming these are brand name machines rather than generics you should be able to track down the manufacturer ( http://www.coffer.com/mac_find/ ), that may narrow you search slightly (assuming you don't have all Dell or similar).

You can use the IP address and a port scanner like nmap to finger print the host and find the likely OS it's running, perhaps narrowing it down further.

If the host is running Windows it will display an error if it detects an IP conflict on the network - I'd suggest intentionally causing an IP conflict and using that method to flag up an alert on the screen of likely candidates.

2
  • 3
    +1 Triggering an IP conflict is a good idea.
    – egorgry
    Mar 18, 2011 at 12:24
  • so easy, so functional :) Windows 7 didn't cause the conflict but sweet old windows xp did the job. Very well done, mate.
    – Pitto
    Mar 18, 2011 at 12:37
1

If the switches have SNMP you may be able to find the PC by observing the counters. No guarantee of course but worth a shot.

If that doesn't work it looks to me like you're most likely going to have to resort to some old fashioned tracking. This sort of thing used to be done by unplugging cables until the culprit was found. While that may sound excessively brutal it's part of the price to be paid for such an appallingly set up network.

1

If you have managed switches, you are able to trace the MAC involved and shut down the port - and then just wait for the angry user complaining about the network being down...

tsg

0

If you have unmanaged switches your options are limited but you can always try the disconnect/reconnect trick for your segments. If done logically you should be able to track down the machine pretty quickly and disconnect it, this will get its owners attention.

5
  • Much too switches and much too users involved... I can't wreck the network just to find out where this damn pc is :( I'd really like more to flood this single pc and kill its nic but I can't find how :(
    – Pitto
    Mar 18, 2011 at 11:11
  • You've got the ip address. From there you can get the MAC address and hopefully the host name. Is there no documentation of which user is assigned which computer or which computer has which ip address? In addition, by following Chopper3's suggestion you're not "wrecking" the network, you're temporarily disabling some of it's segments. In addition to that, the fact that everyone is a local admin doesn't preclude you from accessing their computer if you're also an admin. It sounds to me like you're going to have to walk around to each computer to find the problem one.
    – joeqwerty
    Mar 18, 2011 at 11:18
  • I have MAC address and hostname but the hostname's clueless... This network's really bad (300 clients) with each one (more or less) different admin password. I'm ready to get in every room and check but if I can find a tool to flood that pc I can solve in minutes.
    – Pitto
    Mar 18, 2011 at 11:30
  • @Pitto: How serious is this situation for your company? Enough for you to trawl around every machine to find it? If so then, when you find it, don't bother with Admin credentials. Just power the damn thing off and take it away! It's infected with a virus (or something) that's compromising the rest of your system, which also means that it also has ineffective anti-virus software, which ought to be against company policy.
    – Phill W.
    Mar 20, 2019 at 15:02
  • @PhillW. Thanks for asking but I've left the company... A milion years ago :)
    – Pitto
    Mar 20, 2019 at 15:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .