In article <1187161529.945688.88680@l22g2000prc.googlegroups.c om>,
hon123456 wrote:
> I got a ip address which is used through DHCP. Now I want to
>cancel this IP . But
>I cannot locate which machine is using this IP. The machine will be a
>Workstation, Printer or
>Router. How can I locate the machine? Thanks

ping it and look in the ARP cache to find its MAC

From that you can determine the manufacturer of the device
http://coffer.com/mac_find/

--
-- Rod --
rodd(at)polylogics(dot)com

On 8 16 , 2 42 , r...@panix.com (Rod Dorman) wrote:
> In article <1187161529.945688.88...@l22g2000prc.googlegroups.c om>,
>
> hon123456 wrote:
> > I got a ip address which is used through DHCP. Now I want to
> >cancel this IP . But
> >I cannot locate which machine is using this IP. The machine will be a
> >Workstation, Printer or
> >Router. How can I locate the machine? Thanks
>
> ping it and look in the ARP cache to find its MAC
>
> From that you can determine the manufacturer of the devicehttp://coffer.com/mac_find/
>
> --
> -- Rod --
> rodd(at)polylogics(dot)com

Thanks Rod. But I do not know how to look in the ARP cache to find
the MAC.
Can u type example command to show how to look in the ARP cache ?

Thanks.

In article <1187228861.225838.155630@g12g2000prg.googlegroups. com>,
hon123456 wrote:

>> > I got a ip address which is used through DHCP. Now I want to
>> >cancel this IP . But
>> >I cannot locate which machine is using this IP. The machine will be a
>> >Workstation, Printer or
>> >Router. How can I locate the machine? Thanks
>>
>> ping it and look in the ARP cache to find its MAC
>>
>> From that you can determine the manufacturer of the devicehttp://coffer.com/mac_find/


>Thanks Rod. But I do not know how to look in the ARP cache to find
>the MAC.
>Can u type example command to show how to look in the ARP cache ?

Try `arp -a`

See also
http://technet2.microsoft.com/window...7f4ee1033.mspx

However, I wonder if "check the ARP cache to find the IEEE OUI in its
MAC address" is a good useful answer to the original question. It is
not only that the OUI for a single vendor can be in more than one kind
of box. For example, I bet OUIs pointing to HP can be found for printers
as well as workstations and that plenty of boxes with Cisco logos
on the outside t have OUIs that those who have not been watching over the
years which vendors Cisco has "borged" would not recognize as Cisco.

I wonder if the question as stated is what is really wanted instead of
something like some of the first hits for
http://www.google.com/search?q=network+inventory


For lots of information about IEEE OUIs see
http://www.google.com/search?q=IEEE+OUI

My first choice for searching a searchable list of OUIs would be the
the official list at
http://standards.ieee.org/regauth/oui/index.shtml
A quick check of a name I used to know about with both web pages found
answers at coffer.com that seem odd.


Vernon Schryver vjs@rhyolite.com

On 8 16 , 12 27 , v...@calcite.rhyolite.com (Vernon Schryver) wrote:
> In article <1187228861.225838.155...@g12g2000prg.googlegroups. com>,
>
> hon123456 wrote:
> >> > I got a ip address which is used through DHCP. Now I want to
> >> >cancel this IP . But
> >> >I cannot locate which machine is using this IP. The machine will be a
> >> >Workstation, Printer or
> >> >Router. How can I locate the machine? Thanks
>
> >> ping it and look in the ARP cache to find its MAC
>
> >> From that you can determine the manufacturer of the devicehttp://coffer.com/mac_find/
> >Thanks Rod. But I do not know how to look in the ARP cache to find
> >the MAC.
> >Can u type example command to show how to look in the ARP cache ?
>
> Try `arp -a`
>
> See alsohttp://technet2.microsoft.com/windowsserver/en/library/39e7ef09-569a-...
>
> However, I wonder if "check the ARP cache to find the IEEE OUI in its
> MAC address" is a good useful answer to the original question. It is
> not only that the OUI for a single vendor can be in more than one kind
> of box. For example, I bet OUIs pointing to HP can be found for printers
> as well as workstations and that plenty of boxes with Cisco logos
> on the outside t have OUIs that those who have not been watching over the
> years which vendors Cisco has "borged" would not recognize as Cisco.
>
> I wonder if the question as stated is what is really wanted instead of
> something like some of the first hits forhttp://www.google.com/search?q=network+inventory
>
> For lots of information about IEEE OUIs seehttp://www.google.com/search?q=IEEE+OUI
>
> My first choice for searching a searchable list of OUIs would be the
> the official list athttp://standards.ieee.org/regauth/oui/index.shtml
> A quick check of a name I used to know about with both web pages found
> answers at coffer.com that seem odd.
>
> Vernon Schryver v...@rhyolite.com

I have type arp -a 10.129.2.226. But it says No ARP Entries found. I
have ping
10.129.2.226 first. But it still says No ARP Entries found.
10.129.2.226 is
my internal ip.

Thanks

In article <1187242634.928156.54180@j4g2000prf.googlegroups.co m>,
hon123456 wrote:

>I have type arp -a 10.129.2.226. But it says No ARP Entries found. I
>have ping
>10.129.2.226 first. But it still says No ARP Entries found.
>10.129.2.226 is
>my internal ip.

ping some existing -other- machine.

The arp table isn't used to communicate from a machine to the same
machine.

On 8 16 , 1 49 , rober...@hushmail.com (Walter Roberson) wrote:
> In article <1187242634.928156.54...@j4g2000prf.googlegroups.co m>,
>
> hon123456 wrote:
> >I have type arp -a 10.129.2.226. But it says No ARP Entries found. I
> >have ping
> >10.129.2.226 first. But it still says No ARP Entries found.
> >10.129.2.226 is
> >my internal ip.
>
> ping some existing -other- machine.
>
> The arp table isn't used to communicate from a machine to the same
> machine.

Thanks for you all. Now I ping another machine and I can find the ARP
data.

In article , rodd@panix.com (Rod Dorman)
wrote:

> In article <1187161529.945688.88680@l22g2000prc.googlegroups.c om>,
> hon123456 wrote:
> > I got a ip address which is used through DHCP. Now I want to
> >cancel this IP . But
> >I cannot locate which machine is using this IP. The machine will be a
> >Workstation, Printer or
> >Router. How can I locate the machine? Thanks
>
> ping it and look in the ARP cache to find its MAC
>
> From that you can determine the manufacturer of the device
> http://coffer.com/mac_find/

That's one possible way of sleuthing, but an even easier way might be to
just query the device with SNMP:

$ snmpget -v 1 -c public 10.0.1.1 sysDescr.0
SNMPv2-MIB::sysDescr.0 = STRING: Apple Base Station V3.84 Compatible

If you're lucky, whoever installed the thing went to the trouble to
configure a useful value for sysLocation:

$ snmpget -v 1 -c public 10.0.1.1 sysLocation.0
SNMPv2-MIB::sysLocation.0 = STRING: In the living room, next to the TV

although, in a corporate environment, the string is more likely to be
something like, "Building 45, room 1206, rack 5, shelf 3"

The downside of this is that not everything runs SNMP. If my home WiFi
node and my low-end ink jet printer can run SNMP, there's no excuse for
anything in a corporate environment not doing so also, but I digress.

"hon123456" wrote in message
news:1187161529.945688.88680@l22g2000prc.googlegro ups.com...
> Dear all,
>
> I got a ip address which is used through DHCP. Now I want to
> cancel this IP . But
> I cannot locate which machine is using this IP. The machine will be a
> Workstation, Printer or
> Router. How can I locate the machine? Thanks
>

Cancel the IP and the machine will locate itself; you will hear soon that a
certain workstation cannot connect .. or a certain printer does not print
....

In article <_xYwi.63675$fJ5.19885@pd7urf1no>, "eager"
wrote:

> "hon123456" wrote in message
> news:1187161529.945688.88680@l22g2000prc.googlegro ups.com...
> > Dear all,
> >
> > I got a ip address which is used through DHCP. Now I want to
> > cancel this IP . But
> > I cannot locate which machine is using this IP. The machine will be a
> > Workstation, Printer or
> > Router. How can I locate the machine? Thanks
> >
>
> Cancel the IP and the machine will locate itself; you will hear soon that a
> certain workstation cannot connect .. or a certain printer does not print
> ...

Using "unplug it and wait for the phone to ring" is not always a good way
manage your network (although I'll admit, I've used it a few times in the
past). Here's an example of why it might be a bad idea:

http://www.latimes.com/news/nationwo...5,1,6802259.st
ory?coll=la-headlines-nation&ctrack=3&cset=true

"Roy Smith" wrote in message
news:roy-0E40BA.10204416082007@news.panix.com...
> In article <_xYwi.63675$fJ5.19885@pd7urf1no>, "eager"
> wrote:
>
>> "hon123456" wrote in message
>> news:1187161529.945688.88680@l22g2000prc.googlegro ups.com...
>> > Dear all,
>> >
>> > I got a ip address which is used through DHCP. Now I want to
>> > cancel this IP . But
>> > I cannot locate which machine is using this IP. The machine will be a
>> > Workstation, Printer or
>> > Router. How can I locate the machine? Thanks
>> >
>>
>> Cancel the IP and the machine will locate itself; you will hear soon that
>> a
>> certain workstation cannot connect .. or a certain printer does not print
>> ...
>
> Using "unplug it and wait for the phone to ring" is not always a good way
> manage your network (although I'll admit, I've used it a few times in the
> past). Here's an example of why it might be a bad idea:
>
> http://www.latimes.com/news/nationwo...5,1,6802259.st
> ory?coll=la-headlines-nation&ctrack=3&cset=true


"The story you requested is available only to registered members"

In article , "eager"
wrote:

> "The story you requested is available only to registered members"

Try http://blog.wired.com/sterling/2007/...tage-is-b.html

or google for "LAX outage is blamed on a single computer"

Executive summary -- somebody's desktop PC had a bad network interface and
that started a cascade which took down the whole airport.