How to find unknown static IP on unknown sub net ?? Wireshark ??

[antsrealm]

Hi,

I have a device that has a static IP that is unknown on an unknown subnet. How can I find this IP using my laptop. I tried using wireshark directly connected to the device but because it is on another IP range I don't see the traffic.

I have since got this device working but I would like to know for future cases how you can find an IP in this situation. Is there a way to discover a device with an unknown static IP ?

Thanks,
Tony.

 

[adfox]

I generally use nmap and nmap for windows with gui. Check the link.

http://www.cyberciti.biz/networking/nmap-command-examples-tutorials/

You can also use angryIP http://angryip.org/

 

[antsrealm]

Ok, that's great. What would be the recommended settings in AngryIP to scan all possible IP's and how long would that roughly take to scan?

Thanks.

 

[robertkjonesjr]

Having your PC on a different subnet will not limit your ability to possibly identify the unknown IP address. You are looking for ARP packets, generally, and the ones that are ARP requests or gratuitous are particularly useful for this, and they are sent as layer 2 broadcast so you will see them, no matter the IP range.

The issue with the Wireshark method is that it requires the unknown device to send these packets; many do: at startup for IP conflict detection and then sometimes periodically for continued probing. However, not all devices do this.

Sometimes you might get lucky and the device tries to discover it's default gateway, or maybe a DNS server, or even an NTP server, so will issue an ARP request for those IPs. These packets will provide information that you need too.

This assumes the device has a static IP. If it is configured for DHCP or BOOTP, that's a big help. Wireshark will show you those requests - in which case then setup a suitable server to provide the IP and then you would know what it is.

More advanced devices like routers and managed switches often send discovery packets (such as Cisco Discovery Protocol, or CDP, and others) that may contain the IP address in the data that is broadcast/multicast on the wire so inspection of the data in these packets sometimes yield useful information.

Your best chance with this method is to plug the unknown device and your test pc into a switch - just these - and power cycle the unknown device.

IP scanners are great - I personally use nmap or zenmap - but I only use if I know the subnet. I suppose it's possible to scan all possible IP address ranges but I suspect that may take hours/days/weeks? Would never consider it so don't know how long. If you got this route, suggest you assume the unknown device has a private IP address consistent with RFC 1918. This assumption will cut your search space down significantly. Of course it may be an incorrect assumption; you have to evaluate how valid it might be. It's where I would start 100% of the time, unless the device is directly attached to the Internet, and it's possible that the enterprise has been allocated real IPs.

 

[antsrealm]

Yeah thanks. I actually did what you suggested. In my case the device did send a DHCP discovery packet so I hooked up a switch and got the IP that way. But I was left wondering if I wasn't that lucky and it was static how would I find it, hence my post.

This device is vision system camera and the network port is purely used for commissioning and is not normally connected. Meaning the IP could be anything... So I am left to figure out what it is. Assuming I have no other info and I have to scan for it then I assume I have to scan all possible IP's... and that looks like it would take a while.

 

[LadderLogic]

This is not a Cognex In-Sight camera by any chance? For those, there is a method of connecting using MAC address (which is printed on the nameplate) so the IP address can be reset.

 

[The Plc Kid]

You can scan all possible IP v4 addresses with Angry IP scanner on an average laptop within 4-5 hours

 

[Operaghost]

If it is connected to a managed switch you should be able to get it's MAC address from the switch's MAC table which might also show you it's IP address.

OG

 

[antsrealm]

No it's a baumer verisens camera. But I did connect to the camera using a managed switch in the end. I just wanted to know how I could do it if that failed. AngryIP looks good.

Thanks everyone.

 

[NetNathan]

You can scan all possible IP v4 addresses with Angry IP scanner on an average laptop within 4-5 hours

How do you set Angry IP Scanner to do all IP V4 addresses?

 

[SeanT]

Scan range from 0.0.0.0 to 255.255.255.254 and go find something else to do!

 

[The Plc Kid]

How do you set Angry IP Scanner to do all IP V4 addresses?

As SeanT said above.

 

[NetNathan]

How many is that?
Would the correct calculation for quantity be: 255 x 255 x 255 x 254 = 4,211,669,250?

 

[mk42]

By my understanding, it would be 256*256*256*256, so 4,294,967,296. How many of those are actually legal addresses depends entirely on how the subnet masks are set up, and there are a number of areas that are theoretically reserved for specific purposes.

Note that if you try to ping all addresses between 0.0.0.0 and 255.255.255.255, you might have to change your subnet mask before you do so, or do it in sections, otherwise the packets won't get anywhere. Unless the tool automatically changes this for you, you will only be able to address the IP addresses within the subnet your ethernet card is assigned.

 

[YICHUN]

You can try 'cmd' with 'ipconfig' command.