EH-Net

Ethical Hacking Discussions and Related Certifications => Hardware => Topic started by: mortain on February 11, 2011, 09:24:59 AM



Title: Traceroute MAC adresses
Post by: mortain on February 11, 2011, 09:24:59 AM
Hi there.

I am installing a new FAX, The line is comming through a wall port (which links to a PAP and then a switch) which is replyed on a rack.
My problem is that I don't know which port number is it, so I cannot find it on the rack. Although, I have some workstations connected to ports close to it.

I was wondering if is there any way that I could trace a mac (one from a workstation) so I could know the switch that this machine is liked to, then I could easily find the port in cause.



Title: Re: Traceroute MAC adresses
Post by: tturner on February 11, 2011, 12:31:58 PM
A better idea might be to use a kit like http://www.amazon.com/Fluke-PRO3000-Tone-Probe-Kit/dp/accessories/B000FTADX0 and just tone it out. When you trace ports it's a good idea to document them for future use.


Title: Re: Traceroute MAC adresses
Post by: sil on February 11, 2011, 01:12:30 PM
Why don't you just go directly on the switch/router/firewall and do a show arp?

e.g.

Cisco
sh ip ar (I'm lazy)

JunOS
sh arp

AOS (Adtran)
sh ip ar

SSGs
get arp


As far as ports being "close" to one another, means nothing.


Title: Re: Traceroute MAC adresses
Post by: mortain on February 14, 2011, 10:45:17 AM
I could even find the machine by open the Web Interface from switches, but, the fact is that the guy who installed some of the switches that we have, didn't leave the passwords for his behind ... lol... so ... I cannot find it unless I reset the switch.

ARP should be a nice way to find it. but ... as I cannot open the web interface of it, for sure I cannot open any thing else, as, for example, ssh, if it has.


tturner
I have a cable tester which should do the same, as I belive, but, since there are a considerable amount of ports, some of them are connected and have data, some don't but I cannot switch them off, I don't think that this should be a nice way to do it. But, maybe the one that belongs to me.....


Title: Re: Traceroute MAC adresses
Post by: cd1zz on February 14, 2011, 11:25:16 AM
Do it the hard way - at the end of the day look at your switch and see which lights are active, write them all down.

Go unplug your new device and then check the switch to see which port has turned off.


Title: Re: Traceroute MAC adresses
Post by: tturner on February 14, 2011, 12:13:57 PM

tturner
I have a cable tester which should do the same, as I belive, but, since there are a considerable amount of ports, some of them are connected and have data, some don't but I cannot switch them off, I don't think that this should be a nice way to do it. But, maybe the one that belongs to me.....

Why do you have to switch anything off? Plug the tone generator into the wall jack in your office or wherever it is and turn it on. then take the wand and go into the network closet and push the button/pass the wand over the cables/ports until you hear it start beeping. Focus in on port that beeps the loudest and that's the port that corresponds to the jack. Easy peasy.


Title: Re: Traceroute MAC adresses
Post by: mortain on February 15, 2011, 09:58:24 AM


Why do you have to switch anything off? Plug the tone generator into the wall jack in your office or wherever it is and turn it on. then take the wand and go into the network closet and push the button/pass the wand over the cables/ports until you hear it start beeping. Focus in on port that beeps the loudest and that's the port that corresponds to the jack. Easy peasy.

I did it and I couldn't find the port, maybe because it has some cable connected to it, but I can't plug it off.

Do it the hard way - at the end of the day look at your switch and see which lights are active, write them all down.

Go unplug your new device and then check the switch to see which port has turned off.

I did it as well but all the leds stand still.


Title: Re: Traceroute MAC adresses
Post by: cd1zz on February 15, 2011, 10:02:22 AM
Is this an analog fax machine?


Title: Re: Traceroute MAC adresses
Post by: mortain on February 15, 2011, 10:42:23 AM
yesn but it goes through a ATA


Title: Re: Traceroute MAC adresses
Post by: cd1zz on February 15, 2011, 10:48:37 AM
oh i see, you're converting it to VOIP and then back again. I wonder if your ATA's are busted? Do you get LED activity lights on your ATA adapters? If the ATAs are good, and you still don't see any LEDs drop off the switch when you unplug it, there must be another switch along the way - or this drop goes to a different place than you think it does.

Also, make sure on your switch that your LED lights are set to "activity" some switches have settings like "enabled" or the duplex setting.

However, I'm thinking this port doesn't go where you think it does otherwise the toner would have found it.


Title: Re: Traceroute MAC adresses
Post by: mortain on February 15, 2011, 10:50:26 AM
Sorry, forget the ATA, because actually it is not connected to it. lool. this is my intension ... sorry.
Actually the FAX is directely connected to the port. so I want to find it on the rack.


Title: Re: Traceroute MAC adresses
Post by: cd1zz on February 15, 2011, 11:30:50 AM
An analog device is not going to light up an ethernet switch port. Nor will it have a MAC address as you were asking in your first post. You're going to have to tone this out with a network toner from the port on the wall to your patch panel.


Title: Re: Traceroute MAC adresses
Post by: mortain on February 15, 2011, 11:38:41 AM
Since this is a multifunction printer, and it's connected to the network, If I plug the tester to it's cable I can find it on the rack. but .... still have the same problem...


Title: Re: Traceroute MAC adresses
Post by: cd1zz on February 15, 2011, 11:56:40 AM
Dude you're confusing the shit out of me. If you've found the port on the patch panel what seems to be the problem? Cant you just trace the cable to the switch? You might want to provide as many details a possible so people can help you. Based on your original question:

"I was wondering if is there any way that I could trace a mac (one from a workstation) so I could know the switch that this machine is liked to, then I could easily find the port in cause."

It sounds like you're trying to find the port that the multifunction printer is located on the switch? Please provide more details and be much more specific.



Title: Re: Traceroute MAC adresses
Post by: mortain on February 15, 2011, 12:10:05 PM
Oups. sorry.

Ok, so ... The multifunction is connected to the wall, through a port that links to a rack, and then to the switch (which port I cannot find on the rack). I want to know where is this port so I can link the FAX right beside it. All the ports are numbered but these doesn't, so I'm quite blind to it.

Because I should avoid changing cables on the rack, I was wondering if is there any way to find the "footsteps" of a machine by it's mac address.

As I can know the mac of the multifunction printer, (by pinging it), I was wondering if I can know where it is connected to, so I could know which switch is serving the printer and then, open the web interface and find the port number (of the switch) where the machine is connected. Then, I could find the rack port and link the fax.


Is there any way that I can run ARP from the printer???


Title: Re: Traceroute MAC adresses
Post by: cd1zz on February 15, 2011, 04:44:25 PM
What kind of switch do you have?

Most managed switches have the ability to show what mac addresses are living on what port on the switch.

Most printers have the ability to print out a configuration page that tells you the MAC, IP, DNS settings etc etc etc.

cd1zz is gracefully exiting this conversation

Good luck!