How to find an unregistered device on the local network?

Question

System administration

Greetings, Khabarians!
On the local network, from time to time, MAC addresses appear knocking on DHCP to obtain an IP, they do not receive it (ip assignment to mac is done manually). We sin that one of the devices creates a virtual interface and generates MAC addresses (entering them on the Internet shows that no devices are registered behind them). How can I find out which device they belong to? Nmap is not particularly clear because they do not have ip addresses and the packet for millet ip does not live long.
I would appreciate any thoughts, thanks!

Answer 1

If you have managed switches, you can look at their tables. It lists on which port which poppy is hanging.
For cisco, you can unload the table from the console with the command:
sh mac add

Answer 2

Look at the first three bytes of the poppy, who is the manufacturer and figure out what kind of device it might be. If suddenly there is some kind of game - it can be a manually installed poppy.

Answer 3

If there are not many PCs, do arp -a on each PC

Answer 4

Without managed switches, only with handles on computers, for example, you can write a script on ps, but it will only work with computers on win, and only with known ones. If there are no managed switches, put any small managed switches in the cut, but you will have to buy or rent it, and catch the sigma by gradually narrowing it.