Security Basics mailing list archives

Re: Alert when MAC address connects to network


From: Pierre BETOUIN <info16 () ifrance com>
Date: Fri, 24 Oct 2003 21:54:04 +0200

The easiest way is to run tcpdump, with a specific filter and eventually
grep the Ethernet header.

        Pierre

Le jeu 23/10/2003 à 01:07, Peteris Krumins a écrit :
Monday, October 20, 2003, 7:24:59 PM, you wrote:

MR> Hi all!

MR> We've got a problem in our school building. There are a lot of laptops 
MR> in various classrooms and now there is one that has been stolen. We'd 
MR> really like to be alerted when this machine connects again to the 
MR> network and like to get our hands on the one using it now.

MR> Is there a possibility to get alarmed, when a certain MAC address 
MR> connects to our network? Any other recommendations to our problem?

Oh, yes its certainly possible.

The simplest solution would be to write a program, which would
monitor the arp table entries on routers which are on the same network
the laptops can be connected to. If the same mac detected, shoot out
an alert.


P.Krumins


---------------------------------------------------------------------------
Visual & Easy-to-use are not words that you think of when talking about 
network analyzers. Are you sick of the three window text decodes? Download ClearSight Network's Analyzer and see a 
new network analysis tool that 
makes the complex - easy
http://www.securityfocus.com/sponsor/ClearSightNetworks_security-basics_031021
----------------------------------------------------------------------------

_____________________________________________________________________
Envie de discuter en "live" avec vos amis ? Tlcharger MSN Messenger
http://www.ifrance.com/_reloc/m la 1re messagerie instantane de France
-- 
Pierre BETOUIN

GnuPG key :
lynx -dump perso.club-internet.fr/unsignedchr/GnupgKey.asc | gpg
--import

Attachment: signature.asc
Description: Ceci est une partie de message numériquement signée


Current thread: