I have come across a nanoBTS 165AU but since is used and not tested from the previous owner, I guess it has set a static IP.
After turned on is booting (RED light) and then remains (ORANGE not flashing) even if the eth is connected to the router.

Based on observation, constant blinking orange seems to indicate the layer 2 link isn't up (eg it's powered but Ethernet isn't connected). Solid orange is good. Once it's fully booted it seems to be solid orange with a very quick flash off once a second seems to indicate it's trying to find the BSC

At the moment I am trying with ipaccess-find and BtsInstaller to find in on my LAN .
Unfortunately it is not answering and is not even getting an IP from the router by the DHCP daemon.

ipaccess-find / btsinstaller only ever seem to find my BSCs when the machine they're running on is on the same subnet.

The easiest way to track down a rogue bts is to connect it directly to a spare network port in the pc and then run wireshark on it. On boot my BTS sends a number of dhcp inform requests broadcasting it's IP and then starts blasting packets at the BSC address.

Hope this helps,