How Can I Find the IP Address of An Unauthorized Router?

Network Operations Center -- 10/05/2004

Sometimes students connect routers to the ResNet instead of their PCs. We don't advise doing this unless you really know what you're doing. It's too easy to connect it wrong, in which case you will give out incorrect network information to other students PCs and cause them all to disconnect from the Internet. This will not win you many friends.

If you are running a router please read routers.html. If you think you are the victim of someone running a router, follow these steps:

  • Click the Start button, select Run
  • Type CMD and press ENTER. A black command prompt window will open.
  • Type   ipconfig /all   and press ENTER.
  • Look for your IP Address. If it does NOT start with 149.72 then you are being "held captive" by an incorrectly-configured router.
  • Look for the line that says, "DHCP Server". Write down the address next to it. The address will probably look like  192.168.1.1 .   For the following instructions, use this DHCP Server address that you just wrote down .
  • PING the DHCP Server address. For example, type   ping 192.168.1.1    and press ENTER.
  • If this is the correct address of the unauthorized router, and it's operating right now, you will see something like
    c:\windows>ping 192.168.1.1
    
    Pinging 192.168.1.1 with 32 bytes of data:
    
    Reply from 192.168.1.1: bytes=32 time<1ms TTL=64
    Reply from 192.168.1.1: bytes=32 time<1ms TTL=64
    Reply from 192.168.1.1: bytes=32 time<1ms TTL=64
    Reply from 192.168.1.1: bytes=32 time<1ms TTL=64
    
    Ping statistics for 192.168.1.1:
        Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
    Approximate round trip times in milli-seconds:
        Minimum = 0ms, Maximum = 0ms, Average = 0ms
    
    If this is NOT the correct address or if the unauthorized router is off, you will get a series of   Request timed out   instead of   Reply from...  

  • Still at the command prompt in the black windows, type   arp -a  . You should see something like this:
  • C:\WINDOWS>arp -a
    
    Interface: 149.72.63.101 --- 0x10003
      Internet Address      Physical Address      Type
      192.168.1.1           00-90-7f-20-43-7d     dynamic
    

  • Write down the Internet Address and the Physical Address, and e-mail them to NOC(at)dowling.edu (using a friend's PC, or the Library or a Lab PC), or phone them in to the Help Desk. We will try to identify the offending router, block it, and email its owner and the ResLife staff.

[Go Back]