Rogue PC on the Network

Wireshark can help you detect traffic from Rogue PC's, but it can't tell you which port the PC is connected too. You need to use the ARP tables on your routers and the Forwarding Databases on your switches to track down the port. The steps you need to take are:

1. Detect traffic from the Rogue PC with Wireshark. This is the most difficult step, as it might nog be very visible. Once you have the IP address of the Rogue PC, you can continue

2. Log in to the router that is connected to the subnet of which the found IP is part of. Get the ARP entry for that IP and copy the MAC address

3. From the router downwards log into the switches and lookup the MAC address in the forwarding database.

4. If the MAC is found on a switchlink, follow the link to the next switch until you find the access-port on which the MAC is listed. That's where you will find your ROgue PC

Good luck!

If your computer is connected to a Cisco switch which is running CDP, (Cisco Discovery Protocol), then the switch and port number you are connected to is identified in your capture file. You can use the Display Filter, CDP, to narrow down your results and see only that traffic, and you will see "Device ID: SwitchName Port ID: PortID under the Info section of the captured packet. Also, you can use wiresharkportable and tshark to identify ports on other computers in your network by installing wiresharkportable on a jumpdrive, then on the remote computer, runn winpcap installer, and then the following command:

@echo off 
winpcap_4_1_2.exe
tshark -i interface# -R cdp       [where interface# is the number of the interface your are capturing]

save the above from notepad as a .cmd file, like "whoami.cmd". Then run the command from the users computer. There may be a delay while you wait for CDP to broadcast, you can speed this up by opening up the browser and surfing around a little in the background.

There may be a discovery protocol available for nortel switches or others, but I haven't researched those.

Hope this helps, John

Also, while not wireshark, netscantools pro has a feature known has 'switch port mapper'. It will collect all the arp info from your switches and combining that with a ping sweep will show you all the devices connected to your switches including mac and ip and the associated port number.
Very cool :)

John