Track something down on the network -- HOW?

[Team_RGB]

Something on my network is performing a port scan every couple of days. Coworker on a Mac with Norton or Symantec running brought it to my attention. Are there any innocuous devices that might be the culprit? How to I find this thing? Wireshark? Sharks with lasers? I'm guessing it's not malicious, but better safe than sorry.

[brwainer]

Did the norton/symantec on the mac give the IP address? If so, the next step is to get the MAC address (check the arp table on the mac computer right after the next alert, or check your router’s ARP table and/or DHCP). Then you can start tracing the MAC, assuming you have Smart or Managed switches. If you just have dumb switches then there isn’t any way to check their MAC table. You can also take the MAC and look up the hardware vendor online, but this doesn’t always help identify the device.

 

If you have any type of network security appliance (Fing, some firewalls and routers, etc) then those scans are part of its normal operation. Otherwise, you might have a computer that is infected, or an attacker in your network.