Find a rogue device and lock it down

A device showed up that shouldn't be there (placed on purpose or by accident). Find it, identify it, and contain it — safely.

1. Find it. Run Discovery on the segment (it auto-fills Inventory). Open the ARP table to get the IP↔MAC pair.

2. Identify it. Use MAC / OUI to get the vendor; flag it (⚑) to the watchlist. Check Inventory "first seen" to see how long it's been on the network.

3. Locate it. Find the switch and port: SNMP-poll your switches, or SSH in and read the MAC address-table to map the MAC to a physical port, then to the building/closet. (Runbook ▸ "Rogue device check" runs the ARP, MAC/OUI, Inventory and Drift checks for a suspect address in one go — run Discovery yourself first — and "Switch port check" reads ONE port you name on a saved switch — the MACs learned on it, its counters, and interface status — read-only.)

4. Contain it — carefully. The lockout/shutdown is done ON THE SWITCH (port-security sticky-MAC, an ANC/quarantine policy in NAC, or shutting the exact port) AFTER you've verified the port. SubnetSlinger gathers and confirms the evidence; it does not shut ports for you. Containing the wrong port causes an outage — verify building, closet, and port number first, and log it in Incidents/Activity for the ticket.