Ethereal-users: RE: [Ethereal-users] Resolve MAC addresses

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Jeff Parker <jparker@xxxxxxxxxxxx>
Date: Thu, 24 Jan 2002 10:40:15 -0500
> If your network is running DHCP then the server will know the 
> mapping. You
> will need to bribe the system administrator with a beer. 
> (Especially if it's
> you:)
> 
> Bring up DHCP Manager on the server, click around until you 
> bring up the
> mappings and then search for the "unique ID" that matches 
> your MAC address,
> (ie they're the same thing.)
> 
> -- 
> Richard Urwin, Software Design Engineer

I've worked in a number of "test lab" environments
in which people deposit new boxes on the network
and grab an "unused" IP address.

James Thurber tells about a French Western.  
The sheriff is told that an ominous stranger
is in town.  He straps on his six guns and says

	"Alors, I will go and ask him for his identity card."

In Tombstone, gunslingers didn't have identity cards
or stinking badges.  They didn't talk to the sysadmin
to make sure that no one else in town was called Luke:
they just started using the name.  

In a situation like this, it is quite common to know
that there is a machine out there, whose Mac you
may find in tables, whose IP address is unknown.  

There have been a number of things suggested in this
thread.  Each works some of the time.  None work
all of the time.  

	o Look at the DHCP server
		- works if host used DHCP
	o Send network ping
		- works if you know the subnet and
		  if the host responds
	o Look through your ARP cache
		- works if you had an IP conversation
	o Look through Routers ARP cache
		- works if the host used the router

Essentially we have fingerprints, and we want the
phone number.  It is no good hoping that everyone
who comes to town shows up at the police station
and leaves a set of prints.

- jeff parker
- Axiowave Networks