On Thu, 14 Dec 2006, Rick Smith wrote:
I've heard there's a set of bytes in the netflow headers that will tell you the mac address of the host behind the NAT box...
No..not the mac address, but it is reasonable to guess the number of computers behind a nat device. This is based on the TCP timestamp, if I recall correctly. There are a few whitepapers floating around, that google probably could find for you.. :-)
-- Butch Evans Network Engineering and Security Consulting 573-276-2879 http://www.butchevans.com/ Mikrotik Certified Consultant (http://www.mikrotik.com/consultants.html) -- WISPA Wireless List: wireless@wispa.org Subscribe/Unsubscribe: http://lists.wispa.org/mailman/listinfo/wireless Archives: http://lists.wispa.org/pipermail/wireless/
