In those moments where you have a device that you simply cannot connect to, for lack of IP address knowledge, wouldn’t it be nice to be able to quickly obtain the IP.  This document will save you time.  This, of course, only works for devices that have a static IP.  If you can’t get the IP for a device that is using DHCP, you may be able to use a dumb switch in between to do the same, but most likely if you simply restart that device and follow the manufactures instructions, getting an IP should be simple.

                For my test, I am using a laptop with an Ethernet port, just happens to be within the same expected subnet, but the subnet is not required as this does work with a PC in the 192.x.x.x and a device in the 10.x.x.x range.  My secondary device is my Audiocodes MP-114, but we did this same test with a laptop in 10.5.x.x. and a Mediant 1000 that turned out to be in the 192.168.x.x subnet.  This is said to work for cameras, servers, phones, etc.

                The first step is to disable your wireless receiver on your laptop.  If you don’t do this, your PC will realize that it has no network connectivity on your ethernet port and default to the wireless and will not work. 

                Next plug one end of a straight-through cable into the ethernet port of your PC.  Leave the other end disconnected for now.

                Step 3 is to start wireshark and run it on the ethernet port that your cable is connected to.  Your screen should look like the first capture.  There is nothing to capture, THIS IS GOOD.

Step 4 is to connect the other end of the cable into the intended ethernet port of the device.  (If you have multiple ports and are not sure which has the IP, you will just repeat steps 4 and 5 until one talks to you.  The output in my test is in the below capture.

Step 5 is Breaking down what you are seeing.  Looking through the capture above there are lines depicting Broadcast ARP requests from various places.  One is my laptop, which is 10.5.10.46, the other is the AudioCodes device I plugged into.

                Reading across the line, we get the following information:

1.  Time--Timestamp or packet number.

2.   Source—System/Manufacturer   + Manufacturer portion of the MAC address

3.   Destination—Packet type.   ***Looking for Broadcast***

4.  Protocol—Protocol used in the sent packet.

5.  Length—Number of bytes contained in the packet.

6. INFO—Header information for the send packet

                a. either this will show as Who has x.x.x.x , tell me.   First address is usually gateway, Tell is the device that is asking.  If it shows this way, the Tell is the IP of the Audiocodes.

                b. The secondary method is easier to read:  Gratuitous ARP for x.x.x.x  where x.x.x.x is the device.  In my example, 10.5.10.55 is doing the Gratuitous ARP and is Listed in Source as AudioCod, so I have successfully found my device.

At this point, because this is an audiocodes,  put 10.5.10.55 into a web browser and log into the device.  If the IP is with my home subnet, I can plug it into my router/switch, connect up a workstation, and log in.