43

I have a device set with a static IP and subnet mask. I do not know the IP or subnet mask. How can I find the devices IP and subnet mask?

It is a piece of hardware, not a PC. It will not take an IP from DHCP. I have also tried directly plugging in a LAN cable from my PC to the device with Wireshark running to see if I could capture any packets from the device when it starts or has an Ethernet cable plugged in to it – but there appears to be nothing.

The device appears to be working as it flashes on the Ethernet ports.

Is there any software to do pingsweeps across IPs and networks?

10
  • 1
    If you tell us what the device is, people might know how to find out without connecting it to the network, or what they are usually set to. Jun 25, 2011 at 12:28
  • 1
    the device is a proprietary industrial device that was custom made by a europian company. nobody should know what it is. it is the weekend though and cannot get ahold of the company.
    – gpresland
    Jun 25, 2011 at 12:35
  • 1
    @Mike Koval If I recall correctly, I was able to communicate with it by plugging the WAN port directly into a laptop. I used WireShark to sniff all traffic, and once I found an IP address it was trying to communicate with (it was a public IP) I set the IP of my computer as the public IP. I then continued to sniff with WireShark and got a whole lot more information including private IPs from it now via the WAN port since it trusted me as I had a public IP it was supposed to talk to. I then set my IP to a private IP in its range and plugged in to a LAN port.
    – gpresland
    Feb 29, 2012 at 14:17
  • 1
    @Fase The device I am using is not generating any traffic in Wireshark, so I guess I am having a different issue. Thanks anyway for your help! Mar 3, 2012 at 2:47
  • 1
    @MichaelKoval: Does the port light come on when connected directly to your laptop? You might need a crossover cable. Jan 26, 2013 at 17:42

9 Answers 9

29

3 steps

  1. Download, install and start wireshark
  2. Connect the device to the computer with the cable
  3. Restart the device (unplug and plug it back to the power line)

In case the device has a static IP, it should(might) broadcast it's IP on the network, which you should detect with the wireshark.

In case the device has dynamic IP set up, it will ask for an IP adress, in which case connecting it to a router or a computer with DHCP server will resolve the issue.

Note, just today I've seen the sys admin use these steps to find out an unknown IP from the device :)

2
  • 1
    yes, this helps you to find the ip address. But you still won't know the subnet mask of the device.
    – bvdb
    Apr 27, 2016 at 21:25
  • 1
    @bvdb But that can fairly easily be done by process of elimination or bisection. May 27, 2017 at 10:56
9

I recommend netdiscover. You can use it in passive listening mode and detect incoming ARP announcements (using the -p switch) , or just apply some brute force:

netdiscover -S -f -i eth0

Note that this is incredibly fast compared to nmap (maybe I did not tune nmap well enough).

Also that the method suggested in the currently accepted answer (sniffing for ARP announcements using Wireshark) essentially is what the -p mode is doing.

1
  • sudo apt install netdiscover to install under debian
    – themadmax
    Mar 13, 2023 at 10:43
7

You could try Angry IP Scanner or, if you have a Linux server, use arp-scan.

1
  • 2
    I am using this but to manually change my LAN subnet mask over and over again is tiring.
    – gpresland
    Jun 25, 2011 at 12:26
6

this has helped me a few times on Windows.

arp -a

This displays the networks neighbour cache. Its a local cache of IP/MAC address resolutions. Useful to identify new devices that have joined a network and duplicate static IPs.

2
  • Can you explain what this command does? May 31, 2017 at 16:27
  • 1
    just added, hopefully that helps.
    – PodTech.io
    Jun 1, 2017 at 8:18
5

Try this command, it will ping all possible broadcast addresses.

ping 255.255.255.255
3
  • 5
    Does that work in Linux, because it won't in Windows.
    – KCotreau
    Jun 25, 2011 at 12:36
  • @KCotreau It does on Unix, yeah, although I'm not so sure if it delivers the right info.
    – slhck
    Jun 25, 2011 at 12:37
  • 3
    Windows says it cannot ping that address. Guess its Unix only.
    – gpresland
    Jun 25, 2011 at 12:42
5

Assuming that it is plugged into a managed switch, find the switch that it is plugged into, and track it down to the specific port. Log into the switch, and look at the mac-address that is associated with that port. In Cisco land, it would be something along the lines of show mac-address-table | i 5/34 where 5/34 is the port that the device is plugged into.

Once you have the mac address of the device, then you can look at the arp tables on the switch, which should show you an IP. Again, in Cisco, it would be something like sh arp | i FFFF where FFFF is the last 4 characters of the device's mac address.

That will get you as far as the IP address. The you should be able to use a tool like wireshark to watch the traffic, and glean the netmask from the traffic.

2
  • I don't have a cisco router or switch. the device is directly attached to a PC.
    – gpresland
    Jun 25, 2011 at 17:20
  • 1
    It is connected to the PC via an ethernet cable? What does your arp table in windows show?
    – Kirk
    Jun 25, 2011 at 17:50
4

In OSes that don't let you ping the all-ones broadcast address (255.255.255.255), you can usually still ping the "All Hosts" multicast address:

ping 224.0.0.1

All IP stacks for two decades have supported multicast, so they should all respond to that, unless they have an overzealous firewall.

1

I had success on my Linux box using a USB-Ethernet adapter (like this one), and issuing:

$ ping -I eth2 -b 255.255.255.255
-1

Use nmap:

Nmap ("Network Mapper") is a free and open source (license) utility for network exploration or security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and official binary packages are available for Linux, Windows, and Mac OS X. In addition to the classic command-line Nmap executable, the Nmap suite includes an advanced GUI and results viewer (Zenmap), a flexible data transfer, redirection, and debugging tool (Ncat), a utility for comparing scan results (Ndiff), and a packet generation and response analysis tool (Nping).

1
  • 3
    how do I find network nodes with nmap when I don't know the network?
    – gpresland
    Jun 25, 2011 at 13:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .