I have being running Arpwatch now for a couple of days and I am getting an
awful lot of emails about the Macintosh devices we have here.
hostname: <unknown>
ip address: 0.0.0.0
ethernet address: 0:3:93:53:fe:7e
ethernet vendor: Apple Computer, Inc.
old ethernet address: 0:3:93:93:df:36
old ethernet vendor: Apple Computer, Inc.
timestamp: Wednesday, July 30, 2003 9:00:40 +1000
previous timestamp: Wednesday, July 30, 2003 8:53:49 +1000
delta: 6 minutes
I have heaps of these, mostly the ip is 0.0.0.0
Any ideas ?
Thnaks
Matt
--
> -----Original Message-----
> From: Sebastian Kapfer [mailto:[EMAIL PROTECTED]
> Sent: Monday, 28 July 2003 1:24 PM
> To: [EMAIL PROTECTED]
> Subject: RE: mac addresses
>
>
> On Mon, 28 Jul 2003 03:10:06 +0200, Joyce, Matthew wrote:
>
> > I was going to run
> >
> > nmap -sP x.x.x.*
> > arp -a | grep ether |awk '{print $4}'
> >
> > This give me a nice list.
> >
> > but as for scanning this list for entries not included in
> another list
> > I am a bit stuck...
> >
> > ...arpwatch reads like it will do this very well.
>
> If arpwatch doesn't suit you: man diff. :-)
>
> --
> Best Regards, | Hi! I'm a .signature virus. Copy me into
> Sebastian | your ~/.signature to help me spread!
>
>
> --
> To UNSUBSCRIBE, email to [EMAIL PROTECTED]
> with a subject of "unsubscribe". Trouble? Contact
> [EMAIL PROTECTED]
>
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
