Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations Shaun E on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Find hostname from MAC 1

Status
Not open for further replies.

SelbyGlenn

Technical User
Oct 7, 2002
444
GB
Hi there,

I work in a boarding school and almost every evening a student spoofs the IP address of my proxy server to try and get through it. The proxy server is reporting a duplicate IP address and has recorded the MAC address of the culprit. Question is how do I resolve the Hostname of the students PC from their MAC address?

Thanks in advance,


Glenn
BEng MCSE CCA
 
You could try using look @ LAN and leave it running over night, it should report when things change on the network and record hostname and IP. I'm not sure what it will make of the two same addresses.
I would log all students MAC address' before they are allowed to connect to your network as part of the aggreement, this will make it that bit more difficult for them as they will need to spoof a MAC address as well.

 
You could ping the subnet from something on that subnet and do a arp -a command and look through there. Otherwise there are network scanners out there that will do pretty much the same thing and give you info on each host inc. MAC address. I guess the point is though is the device actually on the network with a different IP or does it only get connected when it's being used to spoof the proxy's IP? If you have a managed switch you can look at it's MAC table to which will even allow you to trace the port the computer is plugged into.
 
If you have managed switches, you can search the switch to see where that MAC is connected.

You could also do an arp -a from the server to match the IP with the MAC and work backwards from there, but your best bet is probably your switch if possible.

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top