I would like to identify computers contacting my NTP-server. I can see the IP addresses with: tethereal n -R udp.port==123
but I need also identify MAC address. Is that possible and how?
If you're in the same IP subnet as the machines accessing your server, yes; their MAC address will be in the packet you capture.
If you're not, it's not possible from the capture alone, as packets from any 'remote' (i.e not in the same subnet) machines will have the MAC address of your local router interface in them.
--
Groeten,
Marco.
