On Wed, 2003-07-30 at 01:13, Joyce, Matthew wrote: > I have being running Arpwatch now for a couple of days and I am getting an > awful lot of emails about the Macintosh devices we have here. > > hostname: <unknown> > ip address: 0.0.0.0 > ethernet address: 0:3:93:53:fe:7e > ethernet vendor: Apple Computer, Inc. > old ethernet address: 0:3:93:93:df:36 > old ethernet vendor: Apple Computer, Inc. > timestamp: Wednesday, July 30, 2003 9:00:40 +1000 > previous timestamp: Wednesday, July 30, 2003 8:53:49 +1000 > delta: 6 minutes > > I have heaps of these, mostly the ip is 0.0.0.0 > Any ideas ?
Yep... Appletalk over Ethernet... but not over IP. So they are arping the Appletalk stuff. Seen a ton in previous gigs. -- greg, [EMAIL PROTECTED] REMEMBER ED CURRY! http://www.iwethey.org/ed_curry The holes in your earloabs ever make me think fondly of the pock-marked landscapes upon the lunar surface. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
