We recently turned off DHCP in favor of fixed IP addresses, and in the middle of the old DHCP range for the legacy network segment, we found a device responding to ping but without any of our normal remote access services running (SSH, RDP, SMB/etc).
NMap version identification fails to find anything, and we get the following results:
PROTOCOL STATE SERVICE 1 open icmp 4 open|filtered ip 6 open tcp 17 open udp 66 open|filtered rvd 96 open|filtered scc-sp 136 open|filtered unknown 157 open|filtered unknown 214 open|filtered unknown 235 open|filtered unknown 251 open|filtered unknown MAC Address: B8:AC:6F:95:06:64 (Dell)
We don't get anything back on connecting to any of these open ports, and there is no documentation that any device should be there. All of our known devices are documented, so the existence of this device is a mystery.
I don't like mysterious devices.
Does anybody know what device might have all of these strange ports open?
We have a lot of DELL workstations and servers, but we've checked against every single known asset.
Can anybody suggest a way to access the device?
Or, can anybody suggest how to physically find it other than yanking cables from various hub segments until it becomes unreachable and narrowing down from there?