Find unknown static IP on device

If you work in networking sooner or later there will be a situation where someone will bring you a device that you must connect to your network that was used somewhere else before. That can be something like switch, Fiber channel switch, some security appliance, different controllers etc. In that case this device will often have a static IP address assigned and you will not know whish address that is. In that case you are unable to communicate with the device and if you are connecting it to your network he will have different IP from you subnet. That will make the device unreachable.

You need to find this unknown IP address in some way so you can connect to the device and then change the IP.

The process of determining the IP address of the device where the IP address is forgotten and does not receive a new configuration via DHCP is possible by analyzing the switches MAC address in the ARP table. I have made this process on Cisco equipment. If you have in mind that all switches in order to function properly on network have arp tables and mac-address tables the process will probably be same on other manufacturer equipment to.

First thing is to get MAC address of the device. You will probably find the address on the device body but this is the process if you connect the device to switch port 0/17.
On Cisco Switch 2950 command:

SW#show mac address-table interface fastEthernet 0/17           
Mac Address Table 
Vlan    Mac Address       Type        Ports 
----    -----------       --------    -----   
5       0005.1fff.36c5    DYNAMIC     Fa0/17 
Total Mac Addresses for this criterion: 1

This command will show you the MAC address of a device connected to that port switch. When you specify the MAC address of the device on the core switch (switch on which VLAN interfaces exist for a specific VLAN) execute the command:

L3_SW#show arp | include 36c5 
Internet            5   0005.1fff.36c5  ARPA   Vlan5

36c5 are representing last 4 digits of MAC address. This command will show you the IP address of a device connected to the switch which MAC address is related to IP. If arp table does not contain bind MAC addresses and IP addresses is possible to ping the entire subnet command:


if broadcast ping is impossible due to technical settings or security settings you may try with:

ping is “All Host” multicast address. After pinging all hosts on the network ARP table must contain a “fresh” information about related IP and MAC address.


Leave a Reply