There will be two ways to determine the management IP address of the switch: active and passive. Passive depends on the switch emanating some identifying information such as CDP or LLDP. My Max Power 2020 book covered how to capture CDP and/or LLDP traffic if it is there; the techniques are listed below. The switch should always emanate BPDUs for Spanning Tree purposes and you will be able to see these frames in a capture, but they do not contain Layer 3 information such as an IP address to my knowledge. Ensure that any capture you run is allowed to execute for at least 60 seconds.
As far as active techniques, as Chris said you can try pinging the network broadcast address like this: ping -b 192.168.1.255; then check your ARP cache with arp -an to see if the switch IP has showed up. You can also try ping -b -I (interfacename) 255.255.255.255. But some devices won't answer a broadcast ping for whatever reason, so you could run something like this then check the ARP cache afterward:
#!/bin/sh
CNTR=1
while [ $CNTR -lt 254 ]
do
ping 192.168.1.$CNTR -c 1 -t 1 -n
CNTR=$(( $CNTR + 1 ))
done
Updated 2023 IPS/AV/ABOT R81.20 Course now
available at maxpowerfirewalls.com
