Unknown camera

[PlainName]

There's a camera on our network which isn't one I am aware of. We have a number of different ones around, ranging from doorbells to pukka CCTV things, but this doesn't seem to be one of them. I have blocked the IP address from internet access (thus killing it if it should be, say, a Netvue one) but everything that requires cloud access still works and there is nothing in the router log to suggest it is trying to access off-LAN.

All I know is the web front end, screeny attached. The extra blurb underneath is because the browser isn't IE, but running IE (in a VM) with the appropriate ActiveX (shudder, but needed to enter the password) installed gives the same. User seems to be admin and none of the default passwords or ones I use work. Neither does the common VSS Web admin reset that I found on the intertubes. Admin account is now locked since I tried too much

Any ideas for how to track down wtf this thing is? I don't think it's on WiFi so I guess that technically I could unplug each ethernet connection until it disappears, but I'd prefer not to screw up innocent devices if possible.

[ejeffrey]

If you have a managed switch you should be able to query it's MAC address table.  If not, then I think unplugging things one at a time is what you have to do.

[PlainName]

It's a partly managed switch which doesn't show MACs. Another downwind switch does, but I figure it's not useful since it shows every MAC it's seen, albeit on which port. However, the port it shows is the uplink from the other switch...

Main problem at the moment is doing a ping while I disconnect stuff - can't' see the PC from where the switches are. Got a laptop, of course, but it's WiFi and the WiFi will act as a bridge between disconnected segments. My assistant will be back tomorrow, though

[PlainName]

Solved. It was the first cable I unplugged...

Turned out not to be a camera but a record-less NVR. Sold, and used, as a spot monitor it's basically an NVR with the recording stuff removed. Rather, disabled - it's possible to get into the config and actually set the recording config. There's even the appropriate connectors for a hard disk, but the firmware has been castrated so none of that makes any difference.

Anyway, I only ever use it via the HDMI port, hence not associating the camera-alike webby.

[ejeffrey]

It's a partly managed switch which doesn't show MACs. Another downwind switch does, but I figure it's not useful since it shows every MAC it's seen, albeit on which port. However, the port it shows is the uplink from the other switch...

Well that still narrows it down to "not on the downstream switch" which is handy.

Got a laptop, of course, but it's WiFi and the WiFi will act as a bridge between disconnected segments.

I don't understand this?  If you unplug the port going to the camera, the ping should stop working regardless of the wifi?  Worst case, ssh from the laptop to your desktop and run ping in a terminal.

Can your partially managed switch disable individual ports from the management interface (or, as a hack, move them to a separate VLAN with no other devices)?  That would let you do the cable test from the comfort of your desk chair.

Depending on your setup and your traffic, you might be able to diagnose this with the activity lights.  Flood ping the camera and see which port's activity light goes from "occasional flashing" to "solid on".  This is a case you will probably want to run from your wired computer, so getting an SSH session from your laptop to a wired computer is really helpful.

[PlainName]

Got a laptop, of course, but it's WiFi and the WiFi will act as a bridge between disconnected segments.

I don't understand this?  If you unplug the port going to the camera, the ping should stop working regardless of the wifi?

It's a mesh with multiple WAPs which are connected via UTP but will talk between themselves over 5GHz if wire goes bad. So I could unplug the bridge from, say, the house to my office and it will be reinstated over WiFi. I might then think the guilty product isn't at the other end because I can still ping it...

Can your partially managed switch disable individual ports from the management interface (or, as a hack, move them to a separate VLAN with no other devices)?  That would let you do the cable test from the comfort of your desk chair.

Yes, but it's less painful and quicker to yank the cable

Thanks for you suggestions but, as you can see above, I struck lucky and solved it.