0

I work as a cybersecurity consultant. In a shadow-IT devices hunt, we noticed a few unwanted devices plugged on the network. However, even with its MAC address and IP, there is no way for me to physically identify the device. The company responsible for network management admits they didn't make any mapping of the cables/plug for the building (several buildings, several floors, thousands of employees). All the were able to do is identify one specific switch, not even the plug on it.

I am not used to operate hardware network gears, but have you ever face a similar situation ? In thise case, what would you advice to identify the good ethernet plug where the rogue device is ?

The ultime solution will be to roam in the building and shoot every suspicious device on my own initiative, but given the COVID situation I'm stuck at home...

3
  • Let me first state any "network engineer" who cannot trace a MAC in a (managed) switched network is no network engineer; this is one of the most basic tasks. That said, this has been answered before (years ago)... trace the MAC back to a wall-facing-port, and then start following cables. If you don't have a map of patch-to-keystone, then you indeed have A Problem (tm)
    – Ricky
    Commented Oct 6, 2020 at 23:40
  • That's indeed the point : there is no existing map. Due to my function + Covid restriction I am not the guy allowed to enter the network room and do the job, I can only delegate the task through a ticketing system answered by fellas who barely speak the language. That's a hell...
    – MedAl
    Commented Oct 7, 2020 at 10:38
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Commented Dec 17, 2020 at 22:26

2 Answers 2

1

Put the switch port administratively down.

If it is something important, somebody (or the monitoring) will complain.

In the same time, have somebody go to the cabinet and identify the patch the switch port is connected to, then track down to the physical location.

Personally I use a tone probe to trace cabling when there's no / outdated/ wrong labelling on ports.

You can also:

  • lookup the OID of the mac address, which may (or not) give a clue about the type of device. (just search for "mac address lookup tool").
  • run a scan with a tool like nmap on the IP address, then depending on which ports are opened try to connect to the device on those ports.
1
  • Thanks for the feedback, really appreciate it.
    – MedAl
    Commented Oct 7, 2020 at 10:47
1

As a best practice, you should have an inventory of all your devices in some management scheme (or usually several ones). Even if MAC addresses are not inventoried, it should be no big problem to get them from the device lists (look up names, resolve IP addresses to MAC addresses).

Then, cross compare the MAC addresses on the network with the inventory. Likely there isn't an absolutely complete list, so sort excess MACs by OUI/vendor and add the obviously missed device classes to your inventory. All that is left is rogue - track down and kill: Check the main switch's MAC table for each address, it'll show you the port leading toward it. If that port is another switch, check its MAC table, and so on until the cable leads you to the rogue device.

As JFL has already pointed out, unused network ports should be administratively deactivated. Additionally, there needs to be a policy prohibiting the connection on private/non-company devices. Without it, someone could hook up a badly configured wireless access point and have all your neighbors join your network. Or plug in their malware-infested home laptop. Or ...

2
  • Thanks for the feedback. So I understand an inventory is a pre-requisite in every circumstances, which seems missing here... The next critical incident is going to be a lots of fun.
    – MedAl
    Commented Oct 7, 2020 at 10:47
  • @MedAl ... and such a security policy really helps when you put them in front of your staff and immediately start seeing those weird devices vanishing from the network again. Not all, but some 90% - seriously reduces the tracking efforts. ;-)
    – Zac67
    Commented Oct 7, 2020 at 14:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.