0

I have a headless Windows 7 Pro 32-bit box with no graphics. I connect to it with RDP over the LAN. I have set it up as a DHCP client (with the server providing a static address) with an alternate static address in the APIPA range so that if no DHCP server is available I can connect directly to it with an Ethernet cable (Auto MDIX ports) and use the APIPA address.

If a static address is set on this machine instead of DHCP, the alternate address becomes inactive. If the static address is miss-typed or forgotten how can I access this machine to reset it to DHCP or correct the static address? It has serial and USB ports but only one Ethernet port. I can do any configuration or install software on the device beforehand e.g. something that allows RDP over a serial connection??

Thanks.

4
  • Ping it by computername or use Whiteshark to get its IP-address Nov 17, 2013 at 12:35
  • 1
    Don't forget about EMS! serverfault.com/questions/554298/windows-serial-console
    – Ryan Ries
    Nov 17, 2013 at 15:07
  • Most Windows boxes spew loads of stuff over the network. If you fire up Wireshark for 30 seconds, you will undoubtedly see packets from that box, usually giving you its IP address.
    – Brad
    Nov 17, 2013 at 17:54
  • I didn't know about EMS - Thanks! I don't think pinging by name will work if the box is in the wrong subnet as NetBIOS works over TCP/IP but I will try it.
    – Guy
    Nov 18, 2013 at 10:29

1 Answer 1

1

This doesn't really answer your question, but at the point where you want the server to exist on the network without DHCP, and you're giving it a static IP from DHCP anyway, it seems like you're not gaining a lot with DHCP. I would just give it the same static IP manually that would otherwise come from DHCP. That way you know what IP its on, and you can use that static IP through a direct link just as well as you could a link-local (APIPA) address.

If you don't know the IP then your problem becomes one of network discovery, and a portmap is probably the easiest way. The link-local subnet size is most of a /16 subnet, which means you've the better part of 2^16 hosts to scan (another benefit of choosing a smaller local subnet and configuring statically, rather than using the RFC-defined link-local subnet, is having a lot less hosts to scan). A good portmap utility ( nmap being my favorite) will be able to scan a given port on an entire range of addresses. Unfortunately you may need to run a few different scans to cover the rather arbitrarily (and inconveniently!) defined link-local range 169.254.1.0 - 169.254.254.255, which can't be defined as a CIDR bitmask subnet, as it's 168.254/16 "minus" 169.254.0/24 "minus" 169.254.255.0/24, but you could do something like this in a bash shell:

for i in `seq 1 254`; do 
   nmap -p 3389 169.254.$i.0/24; 
done > rdp-listens.txt 2>&1 

Since that's going to generate a lot of output, I redirected it to a file to peruse after its done. But that's quite a lot of effort, compared to just giving it one static IP on your network and writing it on a post-it note which is stuck to the box :).

There are some other options, including those mentioned by others, but they're not as sure of a slam dunk. Briefly:

Pinging it by computer name might work, if you know the computer name. Unless we're talking about DNS (and though it's possible, most DNS/DHCP configs don't configure DNS A or PTR records between client-supplied hostnames and DHCP-supplied IPS) that would be a windows computer name, and I don't know how the resolution would work exactly.

I'm skeptical about wire sniffing. Wireshark or similar would require actually seeing RDP traffic for this host, to be able to help you determine it's IP. There are a few problems with that. First, unless this is a network sharing a collision domain ( wireless, or a Hub-connected network ), you're never going to see those packets. Given the scenario I'm guessing you're not using wifi, and you'd be about the only person left in the world running a wired network on a Hub, so you probably have a switched ethernet, which means you'd never see that traffic. ( Some fancier switches allow this kind of thing, but since your root problem here is "I'm worried I won't know the IP", I'm guessing this isn't enterprise level). So there's unlikely to be an easy way to sniff this information off the network. Secondly, this would require traffic to be on the network already - given the scenario, I'm guessing there won't be RDP traffic in the scenario where you don't know the IP address, and if there is, you can just ask your compatriots what its IP is :)

One final approach I can think of might be ARP. You should be able to ARP the network address given the MAC address of the network interface. However, I'm not sure the IP in question would necessarily be in the ARP tables.

Hope it helps!

http://en.wikipedia.org/wiki/Link-local_address http://en.wikipedia.org/wiki/Classful_network

1
  • Thanks for your detailed answer. Looking in the ARP table will only work if the attached machine has at one time successfully connected to the box. In the end I decided to remove the ability to set the IP address by the usual means using group policy editor then write my own app which the user uses to change the address which always adds a fixed known secondary or alternate address in the APIPA range. The reason for the APIPA address is that a Win7 machine in default state (DHCP enabled and APIPA alternate) can just plug straight in with an ethernet cable and RDP to the known address.
    – Guy
    Nov 18, 2013 at 10:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .