Get unknown static IP address

Question

I have Debian squeeze machine physically connected to my network. This machine has static IP address which I don't know. It is not possible to connect monitor to this device. Only one possibility to connect to current machine is SSH.

My current network configuration in which my windows machine is running is 192.168.1.xxx/255.255.255.0. I know, that device's I'm trying to connect IP starts with 162.168. How to know my device's IP address? Is there any Linux tools to solve this problem?

Answer 1

Two options spring to mind.

1. If you can connect a keyboard and blind login.

   Once on the system you can ping any address and, with care, you can sniff the network from another box looking for arp requests. You'd use wireshark, tshark or some other sniffing tool.

   Actually, unless the system is particularly quiet, it might try to contact something on the network anyway. Particularly during the boot process. It would be worth sniffing the network for arp requests during such a boot cycle anyway.

2. Add your sniffing system into each 192.168.x.0/24 subnet in turn (x = 0..255).

   Run nmap -sn (ping scan) for all devices on that subnet. If no answer advance to the next and try again.

   For bonus points scan each subnet twice using two different IP addresses, just to ensure you haven't allocated the same one that the hidden system is using.

Answer 2

Use nmap -sP 192.168.1.0/24 to find the ip of everything that answers to ping (if this box doesn't you'll have to read the documentation for nmap to find out how you get it to try a TCP port, I can only remember that it can). And then try every address you don't know (or if you can do it safely, pull the network cable from the machine you're trying to find, and repeat the command, then you should be able to see that it no longer responds).

Answer 3

When you state that the only way to connect to the machine is via SSH it implies that the machine has either a known IP (which you do not know) or a known name. If that is so, just resolve the name:

dig NameOfComputerToSSH

I am giving the example with dig (and it may also be dig +short name), but many other tools are available, like getent, ip, nslookup, host and many more

If the above is not a solution for your case, then: When you state:

physically connected to my network

Does it mean that the computer is able to communicate with other computers on your network or the internet?

If yes, then it must have an IP (either IPv4 or IPv6).

• If IPv4
  You can scan at level 3 (IP level) with (similar to) nmap -sn 192.168.1.1/24 as an user. The command example will only scan the xxx.yyy.1.zzz segment. For all segments (as you state that you only know the 192.168 prefix) you will need to use (very very slow, more than 1 hour ), note the trailing 16:

  nmap -sn 192.168.1.1/16
  

  If you have root access, nmap could execute an ARP scan (faster but still in the hour range) with the same command, or, you can install and try (about 2 minutes 13 seconds for 65536 IPs with default network speed):

  arp-scan --localnet
  

Or, if you must specify the network segment: apr-scan 192.168.11.11/16 or similar.

• If IPv6
  There is NO practical way to scan a local network for existing computers in a reasonable time. The fe80::/64 has 2⁶⁴ IPs, that's 2⁴⁸ (281.474.976.710.656) times the 192.168.x.y range (well, technically the range is fe80::/10, but it must be followed by 54 zeros, so, that's equivalent to the /64). And that is just one of the possible IP ranges an interface could have (interfaces are multihomed).

  But, there is a command to find the neighbors (that have been active):

  ip -6 neigh
  

Answer 4

Use your Router's client list to determine the IP address. Depending on your router model, the page may look different, but use the following as an example from my current connection:

1. Login to your router's configuration page. In your case, this is most likely http://192.168.1.1
2. Navigate the Page Headings until you see a page similar to the following:

You want something on the page similar to the blue box, and you're looking for the information contained in the red box. Note: I've blotted out the MAC Address and Host Name columns for privacy reasons, but a bit of detective work is required:

• From the List of Host Names, match up the IP addresses to the host, and IP's you are sure of, or
• Use Hardware Lister: lshw -C network on each computer you have access to, in conjunction with Coffer's Vendor/Ethernet/Bluetooth MAC Address Lookup and Search, or this prettier Perl Script at Arul's Utilities: MAC Address and OUI Lookup, which explains what a MAC Address is in case you don't know. Match the results from the MAC Lookup tool with the MAC Address in the MAC Address Column.

---

I always advise users to set sensible host names for situations such as these so that the client list can be easily scanned and matched by memory. MAC addresses cannot be set this way but they can be spoofed if needed.