I have a device that can be IP managed through the network. The IP address of the device is lost along with network @ so i don't know the network the device belongs to. I'm trying to use Wireshark to get it back. The only thing i was able to retrieve was the [email protected] of the device and that was from the Spanning Tree frames. By the way i'm using a direct cable connection to the device so i can capture anything that goes out of the port. Any Ideas are very much appreciated. Thnx asked 21 Apr '15, 23:55  dannykaadan edited 21 Apr '15, 23:58 |
2 Answers:
Depending on the type of device, it may try and communicate with it's default gateway or other configured LAN peer. You can try rebooting the device while running an unfiltered capture and looking for ARP packets. These should show you the source IP address. answered 22 Apr '15, 03:42  NickR 1 I got it finally! I just let Wireshark collect everything for about 5 miniutes then, as NickR suggested, i filtered the ARP frames and i got the one from the device showing IP @. Thnx NickR (22 Apr '15, 06:14) dannykaadan |
Unless the device transmits its IP address in a packet, you're in trouble. Usually I would try to do a factory reset, which should be possible as long as you have physical access (and don't care about the config of the device being lost in the process). You could also do an nmap ping scan over all private IP address ranges if you assume that the switch had an IP from that range, but you should only do this while it is not in a production network. This can still fail if someone configured the switch to not have an IP address on the port you're connected to. answered 22 Apr '15, 02:10  Jasper ♦♦ |
what type of device is that (brand and model)?