Device with unknown ip address

[dominicbywater]

Hi,

I was hoping someone could help with a problem.  We had a new linux server installed at a remote office yesterday, unfortunately the guy installing the server forgot to change the IP addresses, doh. 

It's plugged into a C877 and I can see the port is up/up and I see the mac address using 'sh mac-address-table'.  The ip address on the server is unknown but it's unlikely to be in the correct subnet for the vlan it's attached to.

Is there a way I can add an arp entry manually to the router, then ssh to the server and correct the ip address?  Or is there some other way to establish the IP address of the server?  It's gonna be a pain to revisit the office and there's no one there that can get into the server room to do anything from the console.

Any help would be much appreciated.

[cadet alain]

Hi,

what does a ping 255.255.255.255 rep 2 then sh arp tells you  on the router ?

Regards

Alain

Don't forget to rate helpful posts.

[dominicbywater]

Hi Alain,

sh arp didn't show any new entries, but on the console as the ping responses came in I could see the source address of a few things.  The router at the other end of the GRE tunnel and what seems to be a BT router out of dialer 0 responded, but no response from the server on Fa0.

I'll remember the ping 255.255.255.255 command, very useful, I'd never thought to try that :-)

[mfurnival]

It depends what version of IOS you are using but you may be able to use the built in packet capture feature of the IOS:

https://supportforums.cisco.com/docs/DOC-5799

If you restart the Linux server it will probably do a gratuitous arp with its IP address and you should see this in the capture.

[Richard Burts · Accepted solution]

Using the built in packet capture is an interesting idea. But I have a suggestion which is less complex to implement. I suggest that you follow these steps:

- use terminal monitor (and make sure that the logging level for monitor is debugging)

- turn on debug arp

- watch the logs. there should be a message that complains about wrong cable. This is for an ARP request that came from an address that is outside the subnet of the router interface - it should give you the IP address configured on the server.

- after you identify the IP of the server turn off debug arp.

- configure the router interface with a secondary address that would include the server address in its subnet.

- then you should be able to SSH to the server and correct its address.

- when the server is fixed remove the secondary address on the router interface.

Give this a try and let us know how it works.

HTH

Rick

[dominicbywater]

Hi,

thanks everyone for the help, the debug arp showed the IP address and we were able to get on to it remotely and correct put the correct settings.  Some great tips especially the broadcast ping.  Obviously the best thing is to get the IP address right but this doesn't aways happen so it's nice to have a work-around.

The router didn't have a new enough IOS for the packet capture feature but it looks very interesting so I'll try it out sometime.

Thanks again.