RE: Arpwatch (was : mac addresses)

From: Joyce, Matthew (MJoyce_at_ccia.org.au)
Date: 07/30/03

  • Next message: Yves Goergen: "Re: sudo doesn't work" 
    To: debian-user@lists.debian.org
Date: Wed, 30 Jul 2003 15:13:55 +1000

    I have being running Arpwatch now for a couple of days and I am getting an
    awful lot of emails about the Macintosh devices we have here.

                hostname: <unknown>
              ip address: 0.0.0.0
        ethernet address: 0:3:93:53:fe:7e
         ethernet vendor: Apple Computer, Inc.
    old ethernet address: 0:3:93:93:df:36
     old ethernet vendor: Apple Computer, Inc.
               timestamp: Wednesday, July 30, 2003 9:00:40 +1000
      previous timestamp: Wednesday, July 30, 2003 8:53:49 +1000
                   delta: 6 minutes

    I have heaps of these, mostly the ip is 0.0.0.0
    Any ideas ?

    Thnaks

    Matt 

    --
> -----Original Message-----
> From: Sebastian Kapfer [mailto:sebastian_kapfer@web.de] 
> Sent: Monday, 28 July 2003 1:24 PM
> To: debian-user@lists.debian.org
> Subject: RE: mac addresses
> 
> 
> On Mon, 28 Jul 2003 03:10:06 +0200, Joyce, Matthew wrote:
> 
> > I was going to run
> > 
> > nmap -sP x.x.x.*
> > arp -a | grep ether |awk '{print $4}'
> > 
> > This give me a nice list.
> > 
> > but as for scanning this list for entries not included in 
> another list 
> > I am a bit stuck...
> > 
> > ...arpwatch reads like it will do this very well.
> 
> If arpwatch doesn't suit you: man diff. :-)
> 
> -- 
> Best Regards,   |   Hi! I'm a .signature virus. Copy me into
>  Sebastian      |   your ~/.signature to help me spread!
> 
> 
> -- 
> To UNSUBSCRIBE, email to debian-user-request@lists.debian.org 
> with a subject of "unsubscribe". Trouble? Contact 
> listmaster@lists.debian.org
> 
-- 
To UNSUBSCRIBE, email to debian-user-request@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
  • Next message: Yves Goergen: "Re: sudo doesn't work"