Brian wrote: >The other day we had a NIC broadcasting some bogus IPX SAP info. I got >the MAC address because our Netware servers were all displaying the MAC >info while complaining. > >Using all the tools at hand, I was unable to track it down. I viewed the >router's ARP table, no luck there. > > I narrowed it down to one ethernet >segment and strated up ethereal. No luck, this MAC address wasn't showing >up anywhere. > > if you are in a switched environment you`ll not see on your port frames other then from you or to you or broadcast, or rarely frames that switch does nto know where to send. So the only choices that are left, is if its a manageble switch look at its mac address table, it will show you the port it is on. or setup some port to mirror all the segment traffic. Or you can plug yourself instead of a router for that segment for a little while , whith a router IP of course. Every host will try to reach you as a default gateway and you`ll the active mac addresses on the segment. some people suggested pinging broadcast address for the segment, could work, but many OSes do not reply to directed broadcasts. >Is there a good tool to view all the MAC addresses connected to a specific >segment? > > the switch is a very good tool. ony tool such as tcpdump, ethereal, trafshow can show them but only if it actually sees a packet on the wire, on packet no show. you have to make shure that you monitor workstation sees all the traffic on the segment. >-Brian > >_______________________________________________ >TCLUG Mailing List - Minneapolis/St. Paul, Minnesota >http://www.mn-linux.org tclug-list at mn-linux.org >https://mailman.real-time.com/mailman/listinfo/tclug-list > > > _______________________________________________ TCLUG Mailing List - Minneapolis/St. Paul, Minnesota http://www.mn-linux.org tclug-list at mn-linux.org https://mailman.real-time.com/mailman/listinfo/tclug-list