Using tcpdump to determine the IP of unknown devices

Detection method steps:

1. An unknown device accesses a port that is mirrored in both directions on the switch

2. Listen to the image port to obtain arp broadcast packet

3. Mask known ip and ip segments

Such as (shielding known IP:192.168.1.100, shielding known IP segment: 192.168.5.0 IP 24):

Tcpdump-I eth2-p arp and host not 192.168.1.100 and net not 192.168.5.0 Universe 24

"during tcpdump snooping, you need to adjust to block all known IP as much as possible, and you need to shut down and restart unknown devices."

The following unfamiliar IP was found:

14:41:10.068809 arp who-has 10.1.1.2 tell 10.1.1.1

14:41:11.068768 arp who-has 10.1.1.2 tell 10.1.1.1

14:41:12.068752 arp who-has 10.1.1.2 tell 10.1.1.1

You can roughly determine that the IP of this device is 10.1.1.1.

Further testing: if it is known that this device has a web service, you can connect to determine whether this device is or not.