2

I have a device with a static network configuration (DHCP client not enabled).

I don't know the IP address or subnet mask of the device. I only know the MAC address.

The gateway is not configured (0.0.0.0), so it won't broadcast ARP when joining a network.

Using brute force to test ping from 0.0.0.0 to 255.255.255.255 will take excessive time.

How can I find the IP address of this device?

Improve this question
2
  • 1
    Its a long shot but could you configure a /0 (or a couple of /1)s and send out a broadcast packet to see what responds? Also, could you connect it directly to an interface, reboot it and sniff to see what it transmits on startup?
    – davidgo
    Commented Dec 23, 2020 at 3:04
  • may I ask what kind of product is this device?a printer or router？
    – Gloria Gu
    Commented Dec 23, 2020 at 6:51

1 Answer 1

Reset to default
1

You can use a variety of tools that "sniff" the network depending on your Host OS doing the sniffing.

Wireshark is a common cross platform tool for Mac devices IP Scanner is another On Linux you can use tcpdump to dump raw data that can be inspected.

I you know the MAC you can filter on that and extract the host IP address.

Improve this answer
4
  • 2
    The equipment does not reply if it doesn't receive a connection request. So there are no traffic to inspect/sniff.
    – Felipe Radel
    Commented Dec 23, 2020 at 2:12
  • It is a long lost equipment that have other informations and applications in it that can't be lost. So factory reseting for default network configuration is not an option. Furthermore I would like to know which tools could be used in other situations like this.
    – Felipe Radel
    Commented Dec 23, 2020 at 2:22
  • @FelipeRadel Most network stacks transmit a few packets when they first boot up or when they first get link-up on their network interface. So if you run a sniffer in promiscuous mode on a machine directly connected to it via a crossover cable, you'll be able to see what it sends when you first plug in the cable (or when you power-cycle the device). Even with a static IP address, a device will likely do gratuitous ARP to preempt potential IP address conflicts. Gratuitous ARP has been around since the 1990's, so even an old device has a good chance of doing it.
    – Spiff
    Commented Dec 23, 2020 at 3:00
  • I don't know off-hand what tool will let you do this, but try sending an ICMP Echo Request (i.e., ping) packet with destination IP address set to 255.255.255.255 and destination MAC address set to the MAC address you know.
    – Scott - Слава Україні
    Commented Dec 23, 2020 at 3:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .