Find a rogue device and lock it down

Goal: a device showed up that shouldn't be there (placed on purpose or by accident). Find it, identify it, and contain it — safely.

1. Find it. Run Discovery on the segment (it auto-fills Inventory). Open the ARP table to get the IP↔MAC pair.

2. Identify it. Use MAC / OUI lookup to get the vendor; flag it (⚑) to the watchlist. Check Inventory "first seen" to see how long it's been on the network.

3. Locate it. Find the switch and port: SNMP-poll your switches, or SSH in and read the MAC address-table to map the MAC to a physical port, then to the building/closet. (A one-click runbook that does this end to end is on the roadmap.)

4. Contain it — carefully. The lockout/shutdown is done ON THE SWITCH (port-security sticky-MAC, an ANC/quarantine policy in NAC, or shutting the exact port) AFTER you've verified the port. SubnetSlinger gathers and confirms the evidence; it does not shut ports for you. Containing the wrong port causes an outage — verify building, closet, and port number first, and log it in Incidents/Activity for the ticket.