You will have to give more information on the situation, because it sounds like this is community housing or a dorm? Here is the problem, if the attacker that compromised your system is good enough to get in, then he probably wouldn't be using his IP address, as opposed to spoofing this address. If you have his MAC address then you can compare this address with the addresses in arp table of the switch. Use the sh arp command. If this answers your question, then please close and rate. Thanks
