Tag Info

Hot answers tagged

22

You can use nmap 5.0 with --traceroute option. You will also get a portscan for free :). If you want to test a specific port, you can use -p port option. (You should also use -Pn option so that nmap doesn't try to do a regular ICMP probe first). This is an example: $ sudo nmap -Pn --traceroute -p 8000 destination.com PORT STATE SERVICE 8000/tcp open ...


14

Given an IP address, you should be able to find the MAC address of the corresponding host. arp -a On both Windows and Linux will show you the arp cache of that host, mapping IPs to MAC addresses. (Note that this will need to be run on a machine that is on the same IP subnet as the machine you are trying to find). Once you have the MAC address, log on to ...


13

You don't need any third party software. You need to turn on object access auditing and set the auditing options on the file(s) and or folder(s) you want to monitor. This article explains the process for Windows XP but it's the same for W2K3. http://support.microsoft.com/kb/310399


12

Yep, that'll about do it for you. Using the -T{traceflag} startup parameter, that is.


8

If you have CDP enabled and a recent IOS, a nice, fast way to find where a PC is plugged into is by MAC. Use this command on the Cisco router's CLI: traceroute mac xxxx.xxxx.xxxx xxxx.xxxx.xxxx Where xxxx.xxxx.xxxx is the MAC address of the PC. If you don't know the MAC, I would look in the arp-cache for the IP and find the MAC that way. You may want ...


8

This is the way I use these words. Others may have additional or different usages. Depending on the job at hand, I will use the terms differently. Development teams and operations teams have different needs an usage. Monitoring is monitoring. Usually it is ongoing, and preferably automated. Open source tools like Munin, Nagios, and MRTG fall into this ...


7

It looks like gmail won't show the IP if the message was sent from the web interface, but messages sent from an email program, using gmail's SMTP server will have the sending IP in the mail headers.


5

Something that I learned the hard way is that you have to have semicolons before each trace flag. For example, if you were enabling logging of deadlock info to file, your example would become... -dD:\MSSQL10.MSSQLSERVER\MSSQL\DATA\master.mdf;- eD:\MSSQL10.MSSQLSERVER\MSSQL\Log\ERRORLOG;- lD:\MSSQL10.MSSQLSERVER\MSSQL\DATA\mastlog.l ...


5

Looking at an email from y'day sent from Gmail I'm not seeing the sender's IP anywhere in the transport header (just one Gmail server). Google has it, no doubt, but it would probably take getting a subpoena involved to get it.


5

If you've got a non-Windows machine, whois <ip> is your first step. This will tie the IP to a network and possibly even supply you with an 'abuse' contact, usually an email address. You can email an abuse report there. You can also try nslookup <ip> to get a domain name, and look that up on abuse.net. If you're running Windows start with ARIN's ...


5

In 99% of cases, the penultimate hop of a traceroute will not be the default gateway of the destination host. This is because of the way that traceroute works. All IP packets have a -somewhat misnamed- time-to-live (TTL) field. This field is decremented by one by every router that forwards a packet. If a router decrements the TTL to 0, it drops the packet ...


5

Seems like a job for SystemTap, the SystemTap beginners guide by Red Hat has some disk and IO sample scripts to get you started as does sourceware.org.


4

As others have mentioned, there is no direct way to determine what IP is connected to a certain switch port. The reason is that an Ethernet switch works at L2 of the OSI Model, and typically does not inspect higher level layers (Layer 3 -> IP Address). (There are some exceptions in newer hardware) One important note, to use the ping / ARP trick you'll ...


4

Not quite a dupe, but there's a similar question here, which has some suggestions about mapping an IP address to a switch port. In this case, it sounds like the best option is to identify all switch ports that are connected to devices you know about. My suggestions for this (assuming Cisco managed routers/switches): Identify known devices From your first ...


4

I found the answer myself after digging around some more. The directory C:\Windows\System32\LogFiles\WMI\RtBackup stores ETW trace files (extension .etl) for real time event trace sessions. Looking into the RtBackup directory is a little difficult because by default only System has permissions, but my application SetACL Studio can display the contents ...


3

Mail servers hide their senders addresses, especially if they use 'web mail'. In email exchange its server to server and the client always retrieves their email from their server. When they send an email they don't send it directly to googles mail server but it gets sent to their mail server who than hands it off to google. Here is an example of an exchange ...


3

CiscoWorks, or whatever they call it now, will definitely do this for you. There are also SNMP OIDs that can enumerate the ports, the port status, and the CAM table. This will, at the very least, tell you which switchport a MAC address is on. Depending on your switch model you may also be able to view the ARP table. I would start out by searching for ...


3

Check the ARP cache on your switch(es) to find the MAC and Switch Port associated with that IP of the device. This articles should help you: http://www.petri.co.il/csc_arp_cache.htm http://ccnpsecurity.blogspot.com/2011/11/using-mac-address-table-and-arp-cache.html


3

If using dig: dig +trace .... otherwise, run Wireshark to capture the packets.


3

Spiceworks is free and will automatically create a nice map of all components on your network, complete with name, IP, and traffic. Its very easy to use also. http://www.spiceworks.com/


3

The ISP that owns the IP is the only group that really know the identity of the person registered to an IP. The best info you can hope for is what you can get from dnsstuff. If the matter is serious and you want something done about it, then your only option would be to report it to the police. You could drop everything from that IP address in your ...


3

All sorts of things -- what OS your machine (or router -- whatever's directly connected to that IP address) is running, what services might be running on there, anything that can be determined by talking to the services provided on that IP address (Windows file sharing is the best one, but even a mailserver or FTP server can provide all sorts of info). More ...


2

Depending on the attack, (DoS, certain port scans, etc), the IP Address will most likely be spoofed. And, as others have already stated, even if you do get a valid (non-spoofed) IP, most likely the end host is a compromised machine that is being used as a stepping stone/ relay. Also, never "hack-back" This is unethical, most likely illegal where you live, ...


2

You do not give a lot of information what equipment is used. If the switch is a managed switch, you can use the cli, web app, or management software to obtain the MAC addresses detected on a port. These identify the network cards connected to the particular port. Hope this helps.


2

First do continuous ping to/from machine you want to find to other machine in network. You can use pint -t <ip address> in windows for continuos ping. After that on connect to cisco switche using ssh / telnet / console and you you can use show ip arp | include <ip address> command to find mac address of particular machine. You could have ...


2

"show mac-address-table" will show you what MAC addresses the switch has seen on each port. If you want to see it just for a specific port, use "show mac-address-table interface ..." and if you're trying to locate a specific host, use "show mac-address-table address mac address". Your default router is probably a good point to find MAC-to-IP mappings, as ...


2

Scapy has a tcp trace route function described in this Scapy tutorial. Scapy can be installed on Windows, here are the instructions. I am not positive that his function is available in the Windows version, but it might be. It will help to know python, or at least some knowledge of OO (Object Oriented) programing, but you might not need it just to follow ...


2

A TCP trace works in much the same way as a more traditional trace, except that instead of sending out ICMP ECHO or UDP packets (which are often blocked by firewalls and load balancers) with an increasing TTL (time-to-live) in each subsequent batch of packets, it sends out TCP SYN packets, again with an ever-increasing TTL until a response is received from ...


2

Run a packet capture program on the web server and simultaneously run the trace you ran earlier. If the times reported in the capture and in the trace coincide then it's a server issue. If they don't then it's a network issue.


2

I don't know if you've seen them, but Mark Russinovich of Microsoft (formerly of SysInternals who originally wrote Process Explorer) writes regular articles on his blog about diagnosing Windows problems using the Sysinternals tools. This one demonstrates his process as he tries to track down an intermittent Explorer hang (which almost certainnly isn't the ...



Only top voted, non community-wiki answers of a minimum length are eligible