HomeCalendarCertificationsColumnsFeaturesForumResourcesVitals
 
Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.
Lost Password?
No account yet? Register
Who's Online
We have 37 guests and 1 member online
 
Advertisement

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Hardwarearrow Traceroute MAC adresses
EH-Net
May 18, 2013, 11:38:13 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1] 2   Go Down
« previous next »
  Print  
Author Topic: Traceroute MAC adresses  (Read 15553 times)
0 Members and 1 Guest are viewing this topic.
mortain
Newbie
*
Offline Offline

Posts: 7


View Profile
« on: February 11, 2011, 09:24:59 AM »
Hi there.

I am installing a new FAX, The line is comming through a wall port (which links to a PAP and then a switch) which is replyed on a rack.
My problem is that I don't know which port number is it, so I cannot find it on the rack. Although, I have some workstations connected to ports close to it.

I was wondering if is there any way that I could trace a mac (one from a workstation) so I could know the switch that this machine is liked to, then I could easily find the port in cause.
Logged
tturner
Sr. Member
****
Offline Offline

Posts: 432


View Profile WWW
« Reply #1 on: February 11, 2011, 12:31:58 PM »
A better idea might be to use a kit like http://www.amazon.com/Fluke-PRO3000-Tone-Probe-Kit/dp/accessories/B000FTADX0 and just tone it out. When you trace ports it's a good idea to document them for future use.
Logged
Certifications:
CISSP, CISA, GPEN, GWAPT, GAWN, GCIA, GCIH, GSEC, OPSE, CSWAE, CSTP, VCP

WIP: OSWP, GSSP-JAVA, GXPN

Udacity on hold, again. I suck.

http://sentinel24.com/blog  @tonylturner http://bsidesorlando.org
sil
Hero Member
*****
Offline Offline

Posts: 549



View Profile WWW
« Reply #2 on: February 11, 2011, 01:12:30 PM »
Why don't you just go directly on the switch/router/firewall and do a show arp?

e.g.

Cisco
sh ip ar (I'm lazy)

JunOS
sh arp

AOS (Adtran)
sh ip ar

SSGs
get arp


As far as ports being "close" to one another, means nothing.
Logged
http://www.infiltrated.net/mgz/puppylecter.jpg
mortain
Newbie
*
Offline Offline

Posts: 7


View Profile
« Reply #3 on: February 14, 2011, 10:45:17 AM »
I could even find the machine by open the Web Interface from switches, but, the fact is that the guy who installed some of the switches that we have, didn't leave the passwords for his behind ... lol... so ... I cannot find it unless I reset the switch.

ARP should be a nice way to find it. but ... as I cannot open the web interface of it, for sure I cannot open any thing else, as, for example, ssh, if it has.


tturner
I have a cable tester which should do the same, as I belive, but, since there are a considerable amount of ports, some of them are connected and have data, some don't but I cannot switch them off, I don't think that this should be a nice way to do it. But, maybe the one that belongs to me.....
« Last Edit: February 14, 2011, 10:49:16 AM by mortain » Logged
cd1zz
Hero Member
*****
Offline Offline

Posts: 561


View Profile WWW
« Reply #4 on: February 14, 2011, 11:25:16 AM »
Do it the hard way - at the end of the day look at your switch and see which lights are active, write them all down.

Go unplug your new device and then check the switch to see which port has turned off.
Logged
OSCE | OSCP | GXPN | OSWP | CISSP
http://www.pwnag3.com
http://www.networkadminsecrets.com
tturner
Sr. Member
****
Offline Offline

Posts: 432


View Profile WWW
« Reply #5 on: February 14, 2011, 12:13:57 PM »
Quote from: mortain on February 14, 2011, 10:45:17 AM

tturner
I have a cable tester which should do the same, as I belive, but, since there are a considerable amount of ports, some of them are connected and have data, some don't but I cannot switch them off, I don't think that this should be a nice way to do it. But, maybe the one that belongs to me.....

Why do you have to switch anything off? Plug the tone generator into the wall jack in your office or wherever it is and turn it on. then take the wand and go into the network closet and push the button/pass the wand over the cables/ports until you hear it start beeping. Focus in on port that beeps the loudest and that's the port that corresponds to the jack. Easy peasy.
« Last Edit: February 14, 2011, 12:17:21 PM by tturner » Logged
Certifications:
CISSP, CISA, GPEN, GWAPT, GAWN, GCIA, GCIH, GSEC, OPSE, CSWAE, CSTP, VCP

WIP: OSWP, GSSP-JAVA, GXPN

Udacity on hold, again. I suck.

http://sentinel24.com/blog  @tonylturner http://bsidesorlando.org
mortain
Newbie
*
Offline Offline

Posts: 7


View Profile
« Reply #6 on: February 15, 2011, 09:58:24 AM »
Quote from: tturner on February 14, 2011, 12:13:57 PM


Why do you have to switch anything off? Plug the tone generator into the wall jack in your office or wherever it is and turn it on. then take the wand and go into the network closet and push the button/pass the wand over the cables/ports until you hear it start beeping. Focus in on port that beeps the loudest and that's the port that corresponds to the jack. Easy peasy.

I did it and I couldn't find the port, maybe because it has some cable connected to it, but I can't plug it off.

Quote from: cd1zz on February 14, 2011, 11:25:16 AM
Do it the hard way - at the end of the day look at your switch and see which lights are active, write them all down.

Go unplug your new device and then check the switch to see which port has turned off.

I did it as well but all the leds stand still.
Logged
cd1zz
Hero Member
*****
Offline Offline

Posts: 561


View Profile WWW
« Reply #7 on: February 15, 2011, 10:02:22 AM »
Is this an analog fax machine?
Logged
OSCE | OSCP | GXPN | OSWP | CISSP
http://www.pwnag3.com
http://www.networkadminsecrets.com
mortain
Newbie
*
Offline Offline

Posts: 7


View Profile
« Reply #8 on: February 15, 2011, 10:42:23 AM »
yesn but it goes through a ATA
Logged
cd1zz
Hero Member
*****
Offline Offline

Posts: 561


View Profile WWW
« Reply #9 on: February 15, 2011, 10:48:37 AM »
oh i see, you're converting it to VOIP and then back again. I wonder if your ATA's are busted? Do you get LED activity lights on your ATA adapters? If the ATAs are good, and you still don't see any LEDs drop off the switch when you unplug it, there must be another switch along the way - or this drop goes to a different place than you think it does.

Also, make sure on your switch that your LED lights are set to "activity" some switches have settings like "enabled" or the duplex setting.

However, I'm thinking this port doesn't go where you think it does otherwise the toner would have found it.
Logged
OSCE | OSCP | GXPN | OSWP | CISSP
http://www.pwnag3.com
http://www.networkadminsecrets.com
mortain
Newbie
*
Offline Offline

Posts: 7


View Profile
« Reply #10 on: February 15, 2011, 10:50:26 AM »
Sorry, forget the ATA, because actually it is not connected to it. lool. this is my intension ... sorry.
Actually the FAX is directely connected to the port. so I want to find it on the rack.
Logged
cd1zz
Hero Member
*****
Offline Offline

Posts: 561


View Profile WWW
« Reply #11 on: February 15, 2011, 11:30:50 AM »
An analog device is not going to light up an ethernet switch port. Nor will it have a MAC address as you were asking in your first post. You're going to have to tone this out with a network toner from the port on the wall to your patch panel.
Logged
OSCE | OSCP | GXPN | OSWP | CISSP
http://www.pwnag3.com
http://www.networkadminsecrets.com
mortain
Newbie
*
Offline Offline

Posts: 7


View Profile
« Reply #12 on: February 15, 2011, 11:38:41 AM »
Since this is a multifunction printer, and it's connected to the network, If I plug the tester to it's cable I can find it on the rack. but .... still have the same problem...
Logged
cd1zz
Hero Member
*****
Offline Offline

Posts: 561


View Profile WWW
« Reply #13 on: February 15, 2011, 11:56:40 AM »
Dude you're confusing the shit out of me. If you've found the port on the patch panel what seems to be the problem? Cant you just trace the cable to the switch? You might want to provide as many details a possible so people can help you. Based on your original question:

"I was wondering if is there any way that I could trace a mac (one from a workstation) so I could know the switch that this machine is liked to, then I could easily find the port in cause."

It sounds like you're trying to find the port that the multifunction printer is located on the switch? Please provide more details and be much more specific.

Logged
OSCE | OSCP | GXPN | OSWP | CISSP
http://www.pwnag3.com
http://www.networkadminsecrets.com
mortain
Newbie
*
Offline Offline

Posts: 7


View Profile
« Reply #14 on: February 15, 2011, 12:10:05 PM »
Oups. sorry.

Ok, so ... The multifunction is connected to the wall, through a port that links to a rack, and then to the switch (which port I cannot find on the rack). I want to know where is this port so I can link the FAX right beside it. All the ports are numbered but these doesn't, so I'm quite blind to it.

Because I should avoid changing cables on the rack, I was wondering if is there any way to find the "footsteps" of a machine by it's mac address.

As I can know the mac of the multifunction printer, (by pinging it), I was wondering if I can know where it is connected to, so I could know which switch is serving the printer and then, open the web interface and find the port number (of the switch) where the machine is connected. Then, I could find the rack port and link the fax.


Is there any way that I can run ARP from the printer???
Logged
Pages: [1] 2   Go Up
  Print  
« previous next »
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com 		Valid XHTML 1.0! Valid CSS!
Page created in 0.078 seconds with 23 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.