In our office we have many PCs, all of them have static IP addresses.
We had a problem with one server with ip dropping off the network occasionally. I unplugged the network cable from the server and from pinged from another host and there was a response.

I searched all PCs to see if any has such ip but i didn't found a one. I changed the server ip to fix the problem, but I still find this rogue device using on the network -- how can I figure out what it is?
Could it be the ip of virtual machine on someone's PC?


A virtual machine's IP would be a possibility.

If you try to find this device you could start determining its MAC address (on Linux by running 'arp' and looking for the bad IP).

Next, if you have managed (layer 2) switches in your network you can ask them to tell you which port has this MAC address associated. Then you can either walk to the port and follow the cable or disable the port and wait until someone angry walks up to you. ;)

  • thanks for your reply the main switch is cisco switch i'll try your solution and tell with result – ahmedsafan86 Dec 9 '12 at 0:08
  • To add to that, once you've found the MAC address you can run it through MAC_Find to find the vendor that it belongs to. It may give you an idea of what and where to look. e.g. if it returns Apple, it could be a Macbook. – Hengjie Dec 9 '12 at 2:43
  • Or just find any other IP addresses with the same MAC address or trace the wire from the port that MAC address is mapped to. – David Schwartz Dec 9 '12 at 6:42
  • i used wireshark the mac address is 64:68:0c:99:51:f4. the problem is that i disabled that network inerface of this network the working interface is on another network , i ping it replies!! i used angry ip scan to see what opened ports on that ip range [1-70000] the result is one port opened 1723 – ahmedsafan86 Dec 9 '12 at 12:35
  • Sorry, it's really hard to follow what you're talking about when you sprinkle IP addresses in the middle of your sentence. I don't understand you. :( – Theuni Dec 9 '12 at 13:01

Install NMap (Linux or Windows) and run:

nmap -vv -o

(-vv = Very Verbose, -o = Detect Operating System)

This should give you a good idea of what kind of device it is, it's MAC Address, open ports, etc.


Your problem was an IP conflict between the server and the other machine To identify the pc that has the IP open command prompt and type nbtstat -A This will provide you with the netbios name of this machine.

  • You're assuming that this is a pure Windows Netbios-based network? – Theuni Dec 8 '12 at 23:59
  • all devices has hostname but this ip return nothing i used this command previously from serverfault.com/questions/88064/… – ahmedsafan86 Dec 9 '12 at 0:06
  • on Cisco switch try to type show mac-address-table and also it can be sh mac address-table, better is to type sh mac? ... and go from there – BluesRhythm Dec 9 '12 at 0:17

If you look in the event log on the Server, you should see a logged event for the IP conflict...in that log entry it will tell you the MAC of the offending device.

Once you have the MAC then you can either apply MAC filtering to know it off your network or use DHCP reservations to give it some IP other than what your server uses. Not sure if you were wanting to return the .10 IP to your server or if you don't care that you had to change it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.