Re: How to find a changing IP on ethernet network

["Maxime Ducharme" <mducharme () cybergeneration com>]

Hi,
  also, do not forget that other tools can be used to spoof MAC
adresses to make things worst.

One of tools I know of :
http://www.laurentconstantin.com/en/netw/netwox/

It can spoof MAC & create virtual hosts in a network
(hosts that arent really up).

I'd suggest to keep tracks of every IPs & MACs in your network
over a period of time, and then try to correlate them.

If the offending IP has always the same MAC, you can take a look
on computers . On Windows you can use

ipconfig /all |find "Physical"

that will show the current MAC in use.

Hope this helps out

Maxime Ducharme Programmeur / Spécialiste en sécurité réseau

----- Original Message ----- 
From: "Ivan Andres Hernandez Puga" <ivan.hernandez () globalsis com ar>
To: <security-basics () securityfocus com>
Sent: Friday, February 20, 2004 9:54 AM
Subject: How to find a changing IP on ethernet network


> Hello. I have a client with a simple Ethernet network with HUB's
> connecting and there is one person that is changing it's IP and creating
> conflicts. What would you do to track down that person? i mean, to find
> who does that?
> Thanks!
> Ivan Hernandez
>
>
> --------------------------------------------------------------------------
-
> Free trial: Astaro Security Linux -- firewall with Spam/Virus Protection
>
> Protect your network with the comprehensive security solution that
> integrates six applications for ease of use and lower TCO.
>
> Firewall - Virus protection - Spam protection - URL blocking - VPN
> - Wireless security.
>
> Download 30-day evaluation at:
> http://www.securityfocus.com/sponsor/Astaro_security-basics_040219
> --------------------------------------------------------------------------
--
>



---------------------------------------------------------------------------
----------------------------------------------------------------------------