Unit 3: Local networks · Lesson 4 of 7 · 16 min
Finding the device behind a MAC
Join DHCP leases, the switch MAC table and the asset list to find exactly where the impostor is plugged in.
mission
- You are
- The analyst closing the spoofing case.
- Situation
- You know the impostor's MAC, 02:42:0a:0a:00:42. Facilities needs a desk, not a MAC address, and IT wants to shut the right port.
- Goal
- Join the three record sets in the lab to find the switch port and what the device called itself.
- Hand in
- The switch port, the leased IP and whether the device is a known asset.
From MAC to desk
Switches print MAC addresses in a different format: 0242.0a0a.0042 is the same as 02:42:0a:0a:00:42, grouped in fours. Search for the last four hex digits, 0042, and both formats match.
Search the DHCP leases
Type 00:42 in the lab's filter. The lease tells you which IP the device was given and the hostname it asked for.
you should see One lease: 10.10.0.66 with the hostname *, meaning the device sent no name at all.
Search the switch table
Switch to the MAC table tab and filter for 0042. The Port column is where the cable plugs in.
you should see A single DYNAMIC entry on one access port.
defender tip A MAC that moves between ports, or many MACs on one access port, are both worth an alert of their own.
Check the asset list
Filter the asset list for the same digits. If nothing matches, the device was never issued by IT.
you should see No match. The device on that port is not a company asset.
What to hand over
MAC 02:42:0a:0a:00:42 is spoofing ARP
Nobody can act on a MAC address.
unknown device, no hostname IP 10.10.0.66 via DHCP at 09:18 switch port Gi1/0/17 action: shut port, collect device
Facilities and IT can both act on it today.
Decide the containment
Disable the switch port, keep the device for investigation and turn on DHCP snooping so unknown devices cannot hand out or claim addresses.
you should see A change request with the port, the MAC and the evidence attached.
What a defender takes away
- 1DHCP, the switch MAC table and the asset list together turn a MAC into a place.
- 2Normalise MAC formats before you compare them.
- 3Unknown devices on access ports should raise an alert on their own.
Questions
0 of 2 solved
Answer each one from what you find on your lab machine.