RE: Tracking back internal incidents to users, not IPs

["Cojocea, Mike (IST)" <Mike.Cojocea () watsonwyatt com>]

> then queries your DHCP server(s) for active leases with MAC adresses,
compares the MAC address to the switch's MAC table, then queries your
database/spreadsheet for jack number to switch port assignments and
updates the user object via an LDAP modify command.  


Have a look at Netdisco (netdisco.org). It does an SNMP walk and dumps
the switch ARP/IP tables into a database which you can query using
CGI+Apache. I used it in a 10K host network and it helped me a lot.
Using Netdisco you can track down a MAC to a port and shut down the port
in a couple of seconds. 

Thanks,
Mike

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------