[SOLVED] discovering rogue devices on network

Gad · 08-16-2014, 01:36 PM

Hello LQ

Is there a way to discover roque devices on our network. I can see the leases on the dhcp server but I was maybe looking into more of a netowrk topology "mapper"

If you need more information please let me know.

Thank you
Marios

smallpond · 08-16-2014, 02:14 PM

A device can be fairly stealthy. It can just choose a static IP so there is no DHCP evidence, and it might only generate connections so have no open ports. The only thing it has to have is a MAC address. If you capture all of the packets on your network and map them to known devices, then the packets whose source MAC address don't map are your rogues. I suppose a super-villain could clone the MAC of one of your actual network devices, but then you could discover it because it no longer acts like a printer, for example.

Gad · 08-16-2014, 03:14 PM

Wireshark will do the trick with your suggested method smallpond.

Thank you!