["Visser, Martin (SNO)" <Martin.Visser@xxxxxxxxxx>]

The easiest way to find a source mac address is looking up the layer 2 forwarding data base on your switch/bridges. This will tell you the port the MAC address has been learned from. (If switches are cascaded you may need to hop to multiple switches).

 

Also you need to remember that a router will rewrite any forwarded IP packets to use it's own MAC address as the source address. Usually the router ARP cache can also be used to determine IP to MAC address mapping.

 

In summary you need to understand what the physical network topology is and then use the tables in the Layer 2 switch/bridge and Layer 3 routers as appropriate.

 

 

 

Martin Visser
Network Consultant - Compaq Global Services

Compaq Computer Australia
410 Concord Road
Rhodes, Sydney NSW 2138
Australia

Phone: +61-2-9022-5630
Mobile: +61-411-254-513
Fax:+61-2-9022-7001
Email:martin.visser@xxxxxxxxxx

-----Original Message-----
From: Tony Wong [mailto:twong@xxxxxxxxxxxxxxxxxxx]
Sent: Tuesday, 19 June 2001 2:32 AM
To: ethereal-users@xxxxxxxxxxxx
Subject: [Ethereal-users] Where to find machine with mac address on network

When I capturing packets with ethereal, I get a lot of MAc addresses both in the source and destination. Where can i find what machine this mac address is on on my network?

 

Also why does the source and destination changes : some ip addresses and some mac addresses?

 

Thanks