Re: How to find hidden host within LAN

["Kurt Buff" <kurt.buff () gmail com>]

On Nov 25, 2007 6:42 AM, desant1 () tin it <desant1 () tin it> wrote:
> Hi everybody
> I'm using RH ES4 with iptables as gateway/firewall for my
> LAN.
> In the last week i notice in the iptables logs that a host within
> my lan is doing a lot of traffic.
> The destination/source address of the
> packets and the used port suggest that this host is using peerToPeer
> application (emule or similar).
> The problem is that i'm not able to
> identify this host within my LAN:
> I can see his IP address (192.168.x.
> y) and i can find his mac address througth ARP, but i can't ping it and
> there is no host within my lan with this Mac address.
> I can't
> traceroute it.
> Can someone help me to find this hidden host?

Are your switches managed? Can you pin down the MAC address to a switch port?

Is it coming over a wireless connection? If so, can you simply deny
that MAC address and see who complains?

Does that IP address do *anything* else on your LAN, and do you log
other activity, or can you put a network capture utility
(wireshark/tcpdump/other) to record anything else that this host is
talking to? if so you should be able to note and correlate login
activity with IP address.
_______________________________________________
firewall-wizards mailing list
firewall-wizards () listserv icsalabs com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards