Hi, I'm new too all this, and I really need to find IP address to hardware at work. It is supposed to have a default IP address, but that is not working, and when I connect it to the router it is not picking up the correct IP address.. So when I connect to it direct with Ethernet, and use Wireshark, the only thing I can see that looks interesting is asked 20 Aug '16, 20:29  tezzin edited 20 Aug '16, 22:43  Jaap ♦ |
This is a static archive of our old Q&A Site.
Please post any new questions and answers at ask.wireshark.org.
need = new* xD sorry bad English
I'd say everything what can be said on this topic is here, except one thing: as you say that you are connected directly to the box (i.e. there are no other traffic sources on the wire than the capturing PC and the box itself), the ARP response you've quoted above must come from either your PC or the box. If the box is made by ABB, the chance that 10.41.246.120 is its IP address is quite high, except that I don't understand why it would send such an ARP response towards an individual MAC.
Also, be aware that finding the IP address is just one part of the fun, as some devices support VLANs so you need to set not only the correct IP subnet but also the correct VLAN to be able to talk to the device. Many, if not most, network card drivers on Windows strip the VLAN tags from frames before handing them over to WinPcap/NPcap, so you can see the source MAC and eventually IP but not the source VLAN. To see it, you need to capture on Linux or be lucky and have a NIC in your Windows PC whose driver can be configured to keep the VLAN tag while capturing.
thank you so much. still got some trouble with this.. as i dont completely understand this stuff ;P
yes, the box (switch) is made by ABB, and it suppose to pick up an ip when i connect it to the network, but it is not.
i have tried to ping 10.41.246.120 and connect to it with the software to enter this hardware with that Ip, but still no success.
Im putting in an picture, maybe you can see some more stuff i need to know :)
this is often a problem with this kind of hardware at my work, sometimes it gets the correct IP, and sometimes its not. so im trying to find a way to find the ip when its not picking the correct one on its own.¨
would help me a lot.
The screenshot is here: http://postimg.org/image/qr6iox7s7/
@tezzin, the picture shows a "gratuitous ARP" message which informs the world that the sender, in this case
00:03:2c:00:6a:0d, uses the IP address indicated, in this case10.41.246.120. So check the MAC address of the switch (it should be on some sticker on it) and if it matches, you can be sure that that packet was really sent by the switch itself.This normally requires that a DHCP server is running in the network, and a newly connected device broadcasts "I'm XXXX and I need an IP address, please offer me one" and the server checks the XXXX and finds out whether it has an address for it, and if yes, it offers it to the device, which then asks for it and gets it assigned. XXXX may include MAC address, device type, maybe some other parameters.
If you say that
it could be possible that there is another DHCP server reachable in the network, which sometimes responds faster than the proper one, so the device gets an IP which is outside the normal subnet. What is the IP address it gets in the working case?
Next, when the device has this "weird" address, did you set the IP address of the network card of your PC which you have directly connected to the DUT (device under test) to something like 10.41.246.121/255.255.255.0? Because if you want two devices to talk together while directly connected by a cable, they must be in the same IP subnet.