If you have a windows DHCP server and it's setup for logging you can just have it and the devices plugged into a separate network ( isolated switch). The DHCP server will capture the MAC address from each device in the DHCP log. You should see something like this:
10,03/23/09,10:21:11,Assign,10.10.1.1,minint-k311fmh8.,00215E21B32E, 10,03/23/09,10:49:59,Assign,10.10.1.2,minint-j9hmcaqo.,00215E61735E, 10,03/23/09,14:55:22,Assign,10.10.1.3,minint-fubicdmi.,00215E21B32E, The DHCP logs are kept in: C:\WINDOWS\system32\dhcp YMMV Chris Bodnar, MCSE Sr. Systems Engineer Distributed Systems Service Delivery - Intel Services Guardian Life Insurance Company of America Email: [email protected] Phone: 610-807-6459 Fax: 610-807-6003 _____ From: Sam Cayze [mailto:[email protected]] Sent: Tuesday, March 24, 2009 5:19 PM To: NT System Admin Issues Subject: Bulk Mac Address Inventory Need some ideas to capture a bunch of mac addresses of devices that are [unfortunately] disconnected from a network and powered off. My only idea so far is to power them up (can only be done one at a time - think 'assembly line'), connect them to another PC, do an ARP -a (or script something to invoke it). Does the device that I am trying to capture the mac from need to have a valid IP on the same network? I see that when I do an arp -a on my machine, it only shows devices that have an IP, and that are on my subnet. I think the devices are set to DHCP, so if I had to I could specify on nic on my machine to push out a lease, then do a arp -a? Ideally, I would like to stick a cord in the device, have the mac populated via script, rinse and repeat for each machine... Ideas? Thanks! Sam ----------------------------------------- This message, and any attachments to it, may contain information that is privileged, confidential, and exempt from disclosure under applicable law. If the reader of this message is not the intended recipient, you are notified that any use, dissemination, distribution, copying, or communication of this message is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete the message and any attachments. Thank you. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
