Need some advice on learning networking

[tsbservice]

Duh. Now I'm feeling really dumb. lol

Billy you're definitely NOT dumb, it's impossible for anyone to know everything

[n25an]

Here's a question for the IT experts on here:

Lets say I suspect that a virus (or something else) is assigning rouge IP address and I want to find out if there's a duplicate IP address. What's the best way to see if there's a duplicate IP address. I know one way is to use a scan tool. I used NetScan Tools Pro and ran an ARP request for the copier IP address. It sent out an ARP request and showed every MAC addresses that's on that IP address. So that's one way. But that's an invasive method and I would need to get permission to run something like that on a customer's network.

Are there any less invasive ways to do this?

yep I thought of the unplug copier thing too... but I got the feeling he was going deeper...
I did a quick search on virus that redirect ip addresseses that led me to dns hijacking as a search term which led me to
DNS hijacks: what to look for - Malwarebytes Labs | Malwarebytes Labs
that article gives an excellent explanation of how it can be accomplished by the virus editing your hostfile and editing your dns entries on your nic... and it goes into other methods as well.. such as router attacks and forced govt internet censorship...

related search terms
dns cache poisoning
dns cache spoofing

at that point you are getting into
white hack ethical hacking and penetration testing...
if you are interested in that stuff... then grab a free copy of kali and install it on a thumb drive you are not using and boot into it from time to time and familiarize yourself... but I warn you that is a field all by itself... so you could be there for a long time...

[BillyCarpenter]

yep I thought of the unplug copier thing too... but I got the feeling he was going deeper...
I did a quick search on virus that redirect ip addresseses that led me to dns hijacking as a search term which led me to
DNS hijacks: what to look for - Malwarebytes Labs | Malwarebytes Labs
that article gives an excellent explanation of how it can be accomplished by the virus editing your hostfile and editing your dns entries on your nic... and it goes into other methods as well.. such as router attacks and forced govt internet censorship...

related search terms
dns cache poisoning
dns cache spoofing

at that point you are getting into
white hack ethical hacking and penetration testing...
if you are interested in that stuff... then grab a free copy of kali and install it on a thumb drive you are not using and boot into it from time to time and familiarize yourself... but I warn you that is a field all by itself... so you could be there for a long time...

I was going deeper than that, I just used a bad example. Let me try again.

Lets say some rouge agent is handing out duplicate addresses. I want to find all devices on the same IP address and I want to find the source that's handing out the rouge IP addresses. What's the best way to do that?

[KenB]

Unplug the copier and if you get a ping Bingo

Always a good idea to run "ipconfig /flushdns" first, before pinging the address. It's possible (however unlikely) to get a false response otherwise.

[KenB]

I was going deeper than that, I just used a bad example. Let me try again.

Lets say some rouge agent is handing out duplicate addresses. I want to find all devices on the same IP address and I want to find the source that's handing out the rouge IP addresses. What's the best way to do that?

Google is your friend. I found this with one simple search:

networking - How do I find if there is a rogue DHCP server on my Network? - Server Fault

[BillyCarpenter]

Google is your friend. I found this with one simple search:

networking - How do I find if there is a rogue DHCP server on my Network? - Server Fault

I did google it before I asked. There were a wide range of suggestions, I'm just not experienced enough to know the best option. Now, in the link you posted, I did read one method that I hadn't read. And that is to disable to primary DHCP server and see if I get response back from somewhere else. So, thanks for the link.

[KenB]

I did google it before I asked. There were a wide range of suggestions, I'm just not experienced enough to know the best option. Now, in the link you posted, I did read one method that I hadn't read. And that is to disable to primary DHCP server and see if I get response back from somewhere else. So, thanks for the link.

You're welcome.

I think the best option would highly depend on what the customer's IT is willing to do, or let you do.

Not a "one size fits all" solution.

[BillyCarpenter]

You're welcome.

I think the best option would highly depend on what the customer's IT is willing to do, or let you do.

Not a "one size fits all" solution.

Point taken, my man. lol

I know I'm going well beyond what I'd normally encounter, but I just can't seem to help myself.

[slimslob]

Keep in mind that back then most color printing was coming from Mac workstations, and they would usually use AppleTalk, so IP printing was fairly rare. Micro$oft didn’t include IP printing in Windows 3.x, 95, or 98, only in NT. There was software to add AppleTalk, such as PC MacLAN and COPSTalk. NT supported AppleTalk natively.

For any Windows OS version the included the net command there was always net use lpt1 \printserver\printer where printserver is the IP address of the printer and printer is the hostname of the print device. It could be put in a batch file used to launch a program or even in the autoexec.bat file.

[skynet]

I was going deeper than that, I just used a bad example. Let me try again.

Lets say some rouge agent is handing out duplicate addresses. I want to find all devices on the same IP address and I want to find the source that's handing out the rouge IP addresses. What's the best way to do that?

err its been said before install wireshark if you have permission