[CLUE-Tech] Finding rogue IPs.

[Warren Raquel]

Ignore my last email since you aren't using managed switches. (I can read, 
really!) I would suggest doing something like a ping flood to the machine 
and following the pretty lights.

At 12:09 PM 11/21/2002 -0700, you wrote:
>Suppose you have a network in your two story office building with around 
>250 network drops (10/100BT hubs).  Suppose one of your servers becomes 
>unreachable and you find that arp gives you a different MAC address than 
>you expect.
>
>Seems like someone has plugged in a machine and given it the same IP as 
>your server, and somehow this rogue machine wins the arp battle.  So your 
>IP has been stolen.
>
>Anyone seen this before?
>
>How would you find the rogue machine to fix the problem?
>
>Dave
>
>_______________________________________________
>CLUE-Tech mailing list
>CLUE-Tech at clue.denver.co.us
>http://clue.denver.co.us/mailman/listinfo/clue-tech