Help me trace a Mac address please

[Simon]

I wonder if any of you can help me with this?

At work the ISP has advised us of an unacceptable level of data being generated by us, what’s really odd is that it was at it’s worst last weekend when the place was shut.

We have used a utility to monitor network traffic and found two non TCP/IP device to be the most likely culprits. We know the Mac addresses to be 48:9C:FE:F0:01:90 and 48:9C:FE:2C:01:A0 Unusual to start with a 48 me thinks.

My question is how can I find out what these devices are? I know it's not the router or servers.

Thanks.

 

[Sp!ke]

There is a nice little utility to be found below. Its shareware so you can download it and use it for 30 days or so for free.

It worked for us in a similar situation. You can just put in the MAC address and the IP ranges you wish to look through and it will give you the IP address of the PC with that patyicular MAC address - thus enabling you to identify the culprit.





http://www.youngzsoft.net/cc-get-mac-address/

 

[scotth_uk]

Here's the master list of MAC's by manufacturer. Indeed 48 is strange, and not listed. Given that most PC's network cards can have their MAC soft set, someone may have been playing.

http://standards.ieee.org/regauth/oui/oui.txt

In the past, I have typically logged on the the switches (if they are decent / command line based) and checked the CAM table. It will show you which port the traffic is seen on. Keep going back through the switches to locate the culprits. Works for finding non IP hosts.

You mentioned that they are non ip hosts, are you passing something other than IP out through your border router?????