Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a headless Windows 7 Pro 32-bit box with no graphics. I connect to it with RDP over the LAN. I have set it up as a DHCP client (with the server providing a static address) with an alternate static address in the APIPA range so that if no DHCP server is available I can connect directly to it with an Ethernet cable (Auto MDIX ports) and use the APIPA address.

If a static address is set on this machine instead of DHCP, the alternate address becomes inactive. If the static address is miss-typed or forgotten how can I access this machine to reset it to DHCP or correct the static address? It has serial and USB ports but only one Ethernet port. I can do any configuration or install software on the device beforehand e.g. something that allows RDP over a serial connection??


share|improve this question

migrated from serverfault.com Nov 17 '13 at 17:14

This question came from our site for professional system and network administrators.

Ping it by computername or use Whiteshark to get its IP-address –  strange walker Nov 17 '13 at 12:35
Don't forget about EMS! serverfault.com/questions/554298/windows-serial-console –  Ryan Ries Nov 17 '13 at 15:07
Most Windows boxes spew loads of stuff over the network. If you fire up Wireshark for 30 seconds, you will undoubtedly see packets from that box, usually giving you its IP address. –  Brad Nov 17 '13 at 17:54
I didn't know about EMS - Thanks! I don't think pinging by name will work if the box is in the wrong subnet as NetBIOS works over TCP/IP but I will try it. –  Guy Nov 18 '13 at 10:29

1 Answer 1

up vote 1 down vote accepted

This doesn't really answer your question, but at the point where you want the server to exist on the network without DHCP, and you're giving it a static IP from DHCP anyway, it seems like you're not gaining a lot with DHCP. I would just give it the same static IP manually that would otherwise come from DHCP. That way you know what IP its on, and you can use that static IP through a direct link just as well as you could a link-local (APIPA) address.

If you don't know the IP then your problem becomes one of network discovery, and a portmap is probably the easiest way. The link-local subnet size is most of a /16 subnet, which means you've the better part of 2^16 hosts to scan (another benefit of choosing a smaller local subnet and configuring statically, rather than using the RFC-defined link-local subnet, is having a lot less hosts to scan). A good portmap utility ( nmap being my favorite) will be able to scan a given port on an entire range of addresses. Unfortunately you may need to run a few different scans to cover the rather arbitrarily (and inconveniently!) defined link-local range -, which can't be defined as a CIDR bitmask subnet, as it's 168.254/16 "minus" 169.254.0/24 "minus", but you could do something like this in a bash shell:

for i in `seq 1 254`; do 
   nmap -p 3389 169.254.$i.0/24; 
done > rdp-listens.txt 2>&1 

Since that's going to generate a lot of output, I redirected it to a file to peruse after its done. But that's quite a lot of effort, compared to just giving it one static IP on your network and writing it on a post-it note which is stuck to the box :).

There are some other options, including those mentioned by others, but they're not as sure of a slam dunk. Briefly:

Pinging it by computer name might work, if you know the computer name. Unless we're talking about DNS (and though it's possible, most DNS/DHCP configs don't configure DNS A or PTR records between client-supplied hostnames and DHCP-supplied IPS) that would be a windows computer name, and I don't know how the resolution would work exactly.

I'm skeptical about wire sniffing. Wireshark or similar would require actually seeing RDP traffic for this host, to be able to help you determine it's IP. There are a few problems with that. First, unless this is a network sharing a collision domain ( wireless, or a Hub-connected network ), you're never going to see those packets. Given the scenario I'm guessing you're not using wifi, and you'd be about the only person left in the world running a wired network on a Hub, so you probably have a switched ethernet, which means you'd never see that traffic. ( Some fancier switches allow this kind of thing, but since your root problem here is "I'm worried I won't know the IP", I'm guessing this isn't enterprise level). So there's unlikely to be an easy way to sniff this information off the network. Secondly, this would require traffic to be on the network already - given the scenario, I'm guessing there won't be RDP traffic in the scenario where you don't know the IP address, and if there is, you can just ask your compatriots what its IP is :)

One final approach I can think of might be ARP. You should be able to ARP the network address given the MAC address of the network interface. However, I'm not sure the IP in question would necessarily be in the ARP tables.

Hope it helps!

http://en.wikipedia.org/wiki/Link-local_address http://en.wikipedia.org/wiki/Classful_network

share|improve this answer
Thanks for your detailed answer. Looking in the ARP table will only work if the attached machine has at one time successfully connected to the box. In the end I decided to remove the ability to set the IP address by the usual means using group policy editor then write my own app which the user uses to change the address which always adds a fixed known secondary or alternate address in the APIPA range. The reason for the APIPA address is that a Win7 machine in default state (DHCP enabled and APIPA alternate) can just plug straight in with an ethernet cable and RDP to the known address. –  Guy Nov 18 '13 at 10:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.