Is it possible to detect NICs in network that are connected to a router but belong to machines that are shutdown
We want to detect if a machine that has been shutdown (still connected to power) has been disconnected from the network. We know what IP that machine has in the network and we have another machine in the same local network that is up.
Are NICs communicating in the network even if their host server is shut down? I am thinking maybe there is a mechanism like that that allows for WOL and maybe other diagnostics. Although I dont know if that machine in particular has WOL switched on.
When the OS is shutdown the TCP/IP stack is no more active, since it is implemented in the OS network layer.
If the OS is down (halted) but the ethernet card is still powered (bus power is on) it is possible that the physical ethernet layer is still active, but this depends not only on the motherboard (many motherboards keep the ethernet card always powered on in order to allow WOL functions) but also on network card driver implementation and which commands the OS has sent to the card while halting.
Given that the card is powered and has not been put in a halted state by the OS, it is possible that it could answer to an ethernet discovery scan done, for example, by a tool like arp-scan
.
In any case, if you don't know it in advance, it will be quite difficult to identify the device by its MAC address only.