Re: [PEN-TEST] MAC -> IP ?

[Abe Getchell <agetchel () KDE STATE KY US>]

        Could this be MAC address of the switch itself?

Thanks,
Abe

Abe L. Getchell - Security Engineer
Division of System Support Services
Kentucky Department of Education
Voice   502-564-2020x225
E-mail  agetchel () kde state ky us
Web     http://www.kde.state.ky.us/



> -----Original Message-----
> From: Kerle, Jens [mailto:jkerle () GMX DE]
> Sent: Saturday, March 17, 2001 5:58 PM
> To: PEN-TEST () SECURITYFOCUS COM
> Subject: [PEN-TEST] MAC -> IP ?
>
>
> Hi,
>
> i am watching our net for changes in IP and MAC (which we
> don't allow). On
> out Switch i can find a MAC, with no known IP. I already
> tried to ping the
> whole IP range and looked in the arp table of my computer,
> but can't find
> the MAC there. If i flush the switch arp table, the MAC comes
> back after
> some seconds, so the 'evil' computer seems to be active.
>
> 1. is there a better way to get the IP if i have the MAC ?
>
> 2. how is it possible to hide your arp requests/response ?
>
> thanks, Jens