Finding IP Addresses

One of my favorite writers in the IT world in general, and in the security world in particular, is Richard Bejtlich of Taosecurity and General Electric. One of the main points that Richard makes again and again in his books and blog posts is that visibility is (or should be) one of the key factors in any type of security design, regardless of whether you’re designing network, host, or application components. In addition to being good security design, “building visibility in” is a vital part of designing an infrastructure that is easy to troubleshoot. Anyone who has worked at all in network management and monitoring knows that there’s a vast array of resources available for visibility into security, performance, or troubleshooting: so much so that there’s an entire industry and even sub-industries dedicated to utilizing, organizing, and managing those resources.Frequently, however, small-to-midsized organizations don’t have a fully developed sense of how to approach security or troubleshooting problems from a visibility standpoint. To start remedying this, let’s take the next few posts to look at tools and techniques that Cisco IOS offers to enhance visibility into what’s actually happening on the network. We’re going to start out very simple: how to find an IP host on a (perhaps poorly documented) network. I hope this isn’t condescendingly simple for a Network World reader, but I’ve noticed in job interviews for junior-level admins that a fairly high percentage of people don’t know how to do this, at least in an organized fashion.Let’s say we’re trying to find the switch port where a host at 10.77.77.10 is located, and the network’s undocumented. The first step is fairly straightforward: traceroute.R4#traceroute 10.77.77.10Type escape sequence to abort.  1 10.1.45.5 4 msec 0 msec 0 msecThis tells us that the last router hop before the host is at 10.1.68.10. Assuming that we have access to that router, the next step is to examine its ARP table:SW2#sh arp | i 10.77.77.10In this case, the router’s hostname gives us a clue that this device might be a layer 3 switch that terminates the VLAN in which the host resides. A couple of filtered commands can help us confirm this quickly:

Tracing the route to 10.77.77.10

  2 10.1.56.6 4 msec 0 msec 4 msec

  3 10.1.68.10 0 msec 4 msec 0 msec

  4 10.77.77.10 4 msec *  0 msec

Internet  10.77.77.10           189   000f.8f08.dad7  ARPA   Vlan77

SW2#sh ver | i IOSThe next step is to determine the interface on which the MAC address associated with the host’s IP address resides:SW2#sh mac-address-table | i dad7Next, we need to determine if there are any layer 2 switches connected to Fa0/23. The easiest way to do this is with CDP. Obviously, it’s possible that there could be a switch that’s not running CDP or doesn’t support it; in that case the biggest clue would be the number of MAC addresses located on Fa0/23. In this case, we’ll just use CDP:SW2#sh cdp nei fa0/23Device ID     Local Intrfce    Holdtme   Capability  Platform   Port IDNext, we’ll access sw1 via SSH from SW2. To find the IP address of sw1, we could use the conventional method of adding the “detail” keyword to the CDP command above. However, in the interest of exposing more useful and somewhat obscure IOS commands, we’ll use a different command that produces less verbose output, giving us exactly what we want:SW2#sh cdp entry sw1.foo.com protocolFinally, we’ll connect to sw1 and determine the interface on which our host resides:SW2#ssh -l test 10.77.77.100 “sh mac-address-table | i dad7″Password: Thus, we see that our host at 10.77.77.10 is located on Fa0/7 of sw1.foo.com. Note that with SSH, we didn’t need to login interactively to execute a single command string. Instead, we just put the command string in quotes and executed as an argument to the “ssh” command.In summary, to find the location of a host on the network:1) Determine the last routed hop in the path to the host, preferably using traceroute.As an alternative to step 3, you could also use the layer 2 traceroute feature found in many Cisco switches. I’ve found this to be somewhat tedious, however, so I’ll leave it as an exercise for the reader.

Cisco IOS Software, C3560 Software (C3560-ADVIPSERVICESK9-M), Version 12.2(25)SEE, RELEASE SOFTWARE (fc2)

SW2#sh ip interface brief | i 77

Vlan77                 10.77.77.1      YES manual up                    up

  77    000f.8f08.dad7    DYNAMIC     Fa0/23

Capability Codes: R – Router, T – Trans Bridge, B – Source Route Bridge

                  S – Switch, H – Host, I – IGMP, r – Repeater, P – Phone

sw1.foo.com   Fas 0/23         170       S I         WS-C3560-2   Fas0/23

Protocol information for sw1.foo.com :

  IP address: 10.77.77.100

  77    000f.8f08.dad7    DYNAMIC     Fa0/7

[Connection to 10.77.77.100 closed by foreign host]

SW2#

2) Connect to that router and search the ARP table for the host’s IP address. Record the associated MAC address.

3) Search the MAC table for the host’s MAC. Iterate this process through any remaining layer 2 switches.