The Ethical Hacker Network - Traceroute MAC adresses

mortain

Newbie

Offline

Posts: 7

Traceroute MAC adresses

« on: February 11, 2011, 09:24:59 AM »

Hi there.

I am installing a new FAX, The line is comming through a wall port (which links to a PAP and then a switch) which is replyed on a rack.
My problem is that I don't know which port number is it, so I cannot find it on the rack. Although, I have some workstations connected to ports close to it.

I was wondering if is there any way that I could trace a mac (one from a workstation) so I could know the switch that this machine is liked to, then I could easily find the port in cause.


	Logged

tturner

Sr. Member

Offline

Posts: 432

Re: Traceroute MAC adresses

« Reply #1 on: February 11, 2011, 12:31:58 PM »

A better idea might be to use a kit like http://www.amazon.com/Fluke-PRO3000-Tone-Probe-Kit/dp/accessories/B000FTADX0 and just tone it out. When you trace ports it's a good idea to document them for future use.


	Logged

Certifications:
CISSP, CISA, GPEN, GWAPT, GAWN, GCIA, GCIH, GSEC, OPSE, CSWAE, CSTP, VCP

WIP: OSWP, GSSP-JAVA, GXPN

Udacity on hold, again. I suck.

http://sentinel24.com/blog @tonylturner http://bsidesorlando.org

sil

Hero Member

Offline

Posts: 549

Re: Traceroute MAC adresses

« Reply #2 on: February 11, 2011, 01:12:30 PM »

Why don't you just go directly on the switch/router/firewall and do a show arp?

e.g.

Cisco
sh ip ar (I'm lazy)

JunOS
sh arp

AOS (Adtran)
sh ip ar

SSGs
get arp

As far as ports being "close" to one another, means nothing.


	Logged

http://www.infiltrated.net/mgz/puppylecter.jpg

mortain

Newbie

Offline

Posts: 7

Re: Traceroute MAC adresses

« Reply #3 on: February 14, 2011, 10:45:17 AM »

I could even find the machine by open the Web Interface from switches, but, the fact is that the guy who installed some of the switches that we have, didn't leave the passwords for his behind ... lol... so ... I cannot find it unless I reset the switch.

ARP should be a nice way to find it. but ... as I cannot open the web interface of it, for sure I cannot open any thing else, as, for example, ssh, if it has.

tturner
I have a cable tester which should do the same, as I belive, but, since there are a considerable amount of ports, some of them are connected and have data, some don't but I cannot switch them off, I don't think that this should be a nice way to do it. But, maybe the one that belongs to me.....


« Last Edit: February 14, 2011, 10:49:16 AM by mortain »	Logged

cd1zz

Hero Member

Offline

Posts: 561

Re: Traceroute MAC adresses

« Reply #4 on: February 14, 2011, 11:25:16 AM »

Do it the hard way - at the end of the day look at your switch and see which lights are active, write them all down.

Go unplug your new device and then check the switch to see which port has turned off.


	Logged

OSCE | OSCP | GXPN | OSWP | CISSP
http://www.pwnag3.com
http://www.networkadminsecrets.com

tturner

Sr. Member

Offline

Posts: 432

Re: Traceroute MAC adresses

« Reply #5 on: February 14, 2011, 12:13:57 PM »

Quote from: mortain on February 14, 2011, 10:45:17 AM

tturner
I have a cable tester which should do the same, as I belive, but, since there are a considerable amount of ports, some of them are connected and have data, some don't but I cannot switch them off, I don't think that this should be a nice way to do it. But, maybe the one that belongs to me.....

Why do you have to switch anything off? Plug the tone generator into the wall jack in your office or wherever it is and turn it on. then take the wand and go into the network closet and push the button/pass the wand over the cables/ports until you hear it start beeping. Focus in on port that beeps the loudest and that's the port that corresponds to the jack. Easy peasy.


« Last Edit: February 14, 2011, 12:17:21 PM by tturner »	Logged

mortain

Newbie

Offline

Posts: 7

Re: Traceroute MAC adresses

« Reply #6 on: February 15, 2011, 09:58:24 AM »

Quote from: tturner on February 14, 2011, 12:13:57 PM

I did it and I couldn't find the port, maybe because it has some cable connected to it, but I can't plug it off.

Quote from: cd1zz on February 14, 2011, 11:25:16 AM

I did it as well but all the leds stand still.


	Logged

cd1zz

Hero Member

Offline

Posts: 561

Re: Traceroute MAC adresses

« Reply #7 on: February 15, 2011, 10:02:22 AM »

Is this an analog fax machine?


	Logged

OSCE | OSCP | GXPN | OSWP | CISSP
http://www.pwnag3.com
http://www.networkadminsecrets.com

mortain

Newbie

Offline

Posts: 7

Re: Traceroute MAC adresses

« Reply #8 on: February 15, 2011, 10:42:23 AM »

yesn but it goes through a ATA


	Logged

cd1zz

Hero Member

Offline

Posts: 561

Re: Traceroute MAC adresses

« Reply #9 on: February 15, 2011, 10:48:37 AM »

oh i see, you're converting it to VOIP and then back again. I wonder if your ATA's are busted? Do you get LED activity lights on your ATA adapters? If the ATAs are good, and you still don't see any LEDs drop off the switch when you unplug it, there must be another switch along the way - or this drop goes to a different place than you think it does.

Also, make sure on your switch that your LED lights are set to "activity" some switches have settings like "enabled" or the duplex setting.

However, I'm thinking this port doesn't go where you think it does otherwise the toner would have found it.


	Logged

OSCE | OSCP | GXPN | OSWP | CISSP
http://www.pwnag3.com
http://www.networkadminsecrets.com

mortain

Newbie

Offline

Posts: 7

Re: Traceroute MAC adresses

« Reply #10 on: February 15, 2011, 10:50:26 AM »

Sorry, forget the ATA, because actually it is not connected to it. lool. this is my intension ... sorry.
Actually the FAX is directely connected to the port. so I want to find it on the rack.


	Logged

cd1zz

Hero Member

Offline

Posts: 561

Re: Traceroute MAC adresses

« Reply #11 on: February 15, 2011, 11:30:50 AM »

An analog device is not going to light up an ethernet switch port. Nor will it have a MAC address as you were asking in your first post. You're going to have to tone this out with a network toner from the port on the wall to your patch panel.


	Logged

OSCE | OSCP | GXPN | OSWP | CISSP
http://www.pwnag3.com
http://www.networkadminsecrets.com

mortain

Newbie

Offline

Posts: 7

Re: Traceroute MAC adresses

« Reply #12 on: February 15, 2011, 11:38:41 AM »

Since this is a multifunction printer, and it's connected to the network, If I plug the tester to it's cable I can find it on the rack. but .... still have the same problem...


	Logged

cd1zz

Hero Member

Offline

Posts: 561

Re: Traceroute MAC adresses

« Reply #13 on: February 15, 2011, 11:56:40 AM »

Dude you're confusing the shit out of me. If you've found the port on the patch panel what seems to be the problem? Cant you just trace the cable to the switch? You might want to provide as many details a possible so people can help you. Based on your original question:

"I was wondering if is there any way that I could trace a mac (one from a workstation) so I could know the switch that this machine is liked to, then I could easily find the port in cause."

It sounds like you're trying to find the port that the multifunction printer is located on the switch? Please provide more details and be much more specific.


	Logged

OSCE | OSCP | GXPN | OSWP | CISSP
http://www.pwnag3.com
http://www.networkadminsecrets.com

mortain

Newbie

Offline

Posts: 7

Re: Traceroute MAC adresses

« Reply #14 on: February 15, 2011, 12:10:05 PM »

Oups. sorry.

Ok, so ... The multifunction is connected to the wall, through a port that links to a rack, and then to the switch (which port I cannot find on the rack). I want to know where is this port so I can link the FAX right beside it. All the ports are numbered but these doesn't, so I'm quite blind to it.

Because I should avoid changing cables on the rack, I was wondering if is there any way to find the "footsteps" of a machine by it's mac address.

As I can know the mac of the multifunction printer, (by pinging it), I was wondering if I can know where it is connected to, so I could know which switch is serving the printer and then, open the web interface and find the port number (of the switch) where the machine is connected. Then, I could find the rack port and link the fax.

Is there any way that I can run ARP from the printer???


	Logged

Pages: [1] 2 Go Up

« previous next »