> Well, it's not that easy, but what you can do is unplug the masq box, so
> that it doesn't interfere, then try pinging that IP address. Someone
> will respond. At that point, you can "arp -an" to see the MAC address.
> That is the hardware ethernet address of the machine's NIC.
>
> Once you have that, you can determine what brand it is (because
> different vendors use different numbers), and that can help you track
> down what machine it might be installed in.
See RFC 1700 (assigned numbers) for a list.
> I don't see how a sniffer will help you find it, because it can be
> anyone on the same ethernet segment. If you had a ethernet switch,
> though, that could tell you right away.
A sniffer doesn't help you directly, but often by poking around inside
the packet data, you can work out who "talks like that". Netbios
traffic is normally a giveaway - full of names. If it's only speaking on
the lpd port, chances are that it's a printer, etc.
Martin.
_______________________________________________
Masq maillist - [EMAIL PROTECTED]
http://tiffany.indyramp.com/mailman/listinfo/masq
Admin requests can be handled by web (above) or [EMAIL PROTECTED]
