RE: Arpwatch (was : mac addresses)

From: Greg Folkert (greg_at_gregfolkert.net)
Date: 07/30/03

  • Next message: Greg Folkert: "Re: 2.4.20 autofs: non-toplevel mounts broken?" 
    To: DebianUser list <debian-user@lists.debian.org>
Date: 30 Jul 2003 01:23:31 -0400

    On Wed, 2003-07-30 at 01:13, Joyce, Matthew wrote:
    > I have being running Arpwatch now for a couple of days and I am getting an
    > awful lot of emails about the Macintosh devices we have here.
    >
    > hostname: <unknown>
    > ip address: 0.0.0.0
    > ethernet address: 0:3:93:53:fe:7e
    > ethernet vendor: Apple Computer, Inc.
    > old ethernet address: 0:3:93:93:df:36
    > old ethernet vendor: Apple Computer, Inc.
    > timestamp: Wednesday, July 30, 2003 9:00:40 +1000
    > previous timestamp: Wednesday, July 30, 2003 8:53:49 +1000
    > delta: 6 minutes
    >
    > I have heaps of these, mostly the ip is 0.0.0.0
    > Any ideas ?

    Yep... Appletalk over Ethernet... but not over IP. So they are arping
    the Appletalk stuff. Seen a ton in previous gigs. 

    -- 
greg, greg@gregfolkert.net
REMEMBER ED CURRY! http://www.iwethey.org/ed_curry
The holes in your earloabs ever make me think fondly of the pock-marked
landscapes upon the lunar surface.
-- 
To UNSUBSCRIBE, email to debian-user-request@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
  • Next message: Greg Folkert: "Re: 2.4.20 autofs: non-toplevel mounts broken?"