If a physically inaccessible computer attached to your local network segment is firewalling all IP traffic, how would you find out if it is up or not?
1
-
Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.– Ron Maupin ♦Dec 25 '18 at 8:24
Add a comment
|
You could check the link state on the device to which it's connected. Also, I'd expect at least an ARP entry on the router to which it's connected, and if a switch is used a MAC entry there.
In addition to that, if it's connected to a switchport you could create a mirror port and check if the host is sending traffic. On a router you could create an access lists which would count packets coming from the host's source address.
You can ARP the IP interface, e.g. in Windows:
arp -d 192.0.2.42
ping -n 1 -t 1 192.0.2.42
arp -a 192.0.2.42
If the node has replied to the ARP request there's a fresh cache entry.
You could also monitor this host passively (i.e. without additional traffic, and without the host "knowing" it is being monitored): Simply listen for any broadcasts from the subject, as long as it communicates to anything else, it would need to refresh its ARP entry for at least the default gateway about once every 5 minutes. Usually, the rate of broadcasts is much higher though. To listen for broadcasts, you do not need to enter the "promiscuous" mode of the network interface, and do not need root privilege to do that (e/g/ us the "-p" option with tcpdump).
