0

Situation : Along with other active hosts, our internal network scan shows an extra 9 IP addresses in the report (no reverse DNS, just IP addresses) with 0 vulnerabilities and 2 INFO 

INFO1 : Nessus scan information
INFO2 : Traceroute : 1 hop.

Problem : No one in the organization knows which IP addresses are these.

I picked up one of the IP addresses : 10.33.10.47

From one(10.33.162.115) of the servers, I tried to reach/scan 10.33.10.47 and:

1) ping says Time to live exceeded

2) A regular nmap -sT scan says the host is up, but no ports open.

3) The wireshark analysis of the packets I captured while running the nmap shows the destination MAC address of our Cisco firewall in the Layer 2 section.

I am yet to hear back from our network team to see if they can find something from the ARP tables. How would I know whether this host is Live or dead. Both the scanning tool(Nessus) and nmap says the host is up, but I am, in no way, able to reach that host.

P:S:- I have posted another question about the same problem, but editing the original question to add my later findings (and there by editing the whole question) would leave a good answer I received on that question slightly out of context, so I have posted this as another question. Hope it is okay.

Improve this question
2
  • What was the MAC address for these IPs when you scanned the Network? Was it also Cisco Firewall?
    – Abu Zaid
    Commented Jun 26, 2018 at 19:41
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 25, 2018 at 8:52

1 Answer 1

Reset to default
1

No one in the organization knows which IP addresses are these.

You should be able to ARP the IP addresses in question and track down the associated MAC addresses through the switches' MAC tables. Follow the cable and you've found the host.

You should consider restricting network connections on the organizational (user policies) or technical level (ACLs, Firewalls, 802.1X, MACSEC, ...) if you don't like surprises.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.