Have IP address but how to find the computer name associated with it

[tls3000]

I searched this but surprisingly didn't find anything so I'm posting it as a question.  How do I find which computer name is associated with a particular IP address.  Trying to track down high bandwidth users via command line.  Thanks.

[Anonymous]

You find the mac in the arp table and then log onto your switches to see what port that mac is on.  If your switches are un-managed it will be a lot harder to figure it out.

[tls3000]

Thanks ricvil. Unfortunately the switches we have here are all unmanaged. I can get the mac from arp I just don’t know what to do with it to get the machine name.

Terry

[petetransitguy]

tls3000, here are the steps:

1. Log into the switch

2. Ping the known IP

3. Make sure you're in "enable" mode

4. Enter the command: "sho ip arp | in [the IP address]"

  4a. The result should give you an output with the IP, MAC address and VLAN

5. Enter the command: "sho mac address-table | in [the last part of the MAC address]"

  5a. On Adtran 1200 switches, you have to type out the MAC in lower-case letters. I usually just do the last part of the MAC, like "a1:2b"

6. The output will give you the VLAN, the full MAC address, whether its DYNAMIC (or not) and the switchport

7. You can then do a "sho run int swx [the switchport]" to get the configuration settings

Depending on the device, your command may be some variation, such as "sho arp" instead of "sho ip arp," but this should work for you.

[Anonymous]

Terry, what are you using as your DHCP server? Depending on that, you may be able to use Peter's suggestion involving looking at the ARP table to get the IP and look at the name on the DHCP server. Thanks

Jay

[Anonymous]

I went ahead and flagged this post as "Assumed Answered". If any of the responses on this thread assisted you, please mark them as Correct or Helpful as the case may be with the applicable buttons. This will make them visible and help other members of the community find solutions more easily. If you still need assistance, we would be more than happy to continue working with you on this - just let us know in a reply.

Thanks,

Jay

[dmac]

If it's a Microsoft/Windows machine then from another windows machine open a command prompt and run the following command:

nbtstat -A <IP Address>

To get help with nbtstat put a "?" after the command.

example:  c:\nbtstat ?

Doug

[tls3000]

thanks guys for all the replies.  all were very helpful.  unfortunately the switches here are unmanaged.  the nbtstat command is nice to know.