MAC address requesting IP but no sign of it on the machine

cowmoo32 · 10-03-2013, 11:20 AM

The network I'm dealing with requires that we register each device's MAC and assign it a static IP. Lately an unregistered device has been making constant requests for an IP and I need to disasble it, but I have no idea where the request is coming from. I know it's in my server room, and it should be coming from a known server given the MAC but when I pull all of the MAC addresses for the server, the one making the request isn't listed.

Code:

$/sbin/ip link show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: em1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP qlen 1000
    link/ether d0:67:e5:fc:02:37 brd ff:ff:ff:ff:ff:ff
3: em2: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
    link/ether d0:67:e5:fc:02:39 brd ff:ff:ff:ff:ff:ff
4: em3: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
    link/ether d0:67:e5:fc:02:3b brd ff:ff:ff:ff:ff:ff
5: em4: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
    link/ether d0:67:e5:fc:02:3d brd ff:ff:ff:ff:ff:ff

The MAC that is making the requests is d0:67:e5:fc:02:3f, so it should be coming from this server. As far as I'm aware there are no virtual machines running on the server (they would be listed with ifconfig -a anyway) so I'm at a loss as to how to find where the request is coming from.

bradvan · 10-03-2013, 12:10 PM

Well d0:67:e5 belongs to Dell. So look for a Dell as a start.

jefro · 10-03-2013, 05:09 PM

Any way to log on to arp in the switches?

baldy3105 · 10-07-2013, 07:53 AM

Do you have access to the server room switch? You should be able to look at the MAC tables on the switche which will tell you which port the mac address is being learned on. This will prove if its the server or just a coincidentally close MAC.