NacTrack
FRGet the demo
Endpoints

How to tell whether an IP belongs to a user device or to network equipment

IP Finder heads each block of results with the source that matched, and that heading is the answer to a question people ask constantly. An address found in an ARP table is something plugged into the network. An address found in the inventory is a device NacTrack manages. The same search box tells you which, without you knowing in advance.

All the questions
The same procedure as a recording, subtitled in English and French. This recording predates the latest revision of the steps: it opens on a screen the written guide no longer includes.
Before you start

What you need

  • Module required: core.
  • Permission required: use_troubleshooting.
  • all

1. Open IP Finder

app.nactrack.com/troubleshooting/ipfinder
Open IP Finder
Open Tools and choose IP Finder.

2. Read the first source heading

app.nactrack.com/troubleshooting/ipfinder
Read the first source heading
The block is headed ARP Table. NacTrack knows this address only because routers resolved it, which means it is something connected to the network rather than part of it.

3. Read the second source heading

app.nactrack.com/troubleshooting/ipfinder
Read the second source heading
The heading has changed to Inventory, and a second block has appeared for the LLDP neighbour that sees this address. Same search box, same syntax, and the answer tells you what kind of thing you found.
The limits

What this view does not tell you

  • The sections that appear depend entirely on what was collected. An endpoint that no router has ARPed since the last collection will not appear at all, even though it is connected.
  • An address can legitimately appear under several sources at once. That is confirmation, not a conflict.

Try the same thing on your own estate

Request accessAll the questionsEvery guide as a PDF (25 MB)