Re: [PEN-TEST] MAC -> IP ?

[Chris Arnold <chris.arnold () WHEELHOUSE COM>]

Determine the switch port they are connected to, disable the port and wait
to see who complains.

Chris

-----Original Message-----
From: Kerle, Jens [mailto:jkerle () GMX DE]
Sent: Saturday, March 17, 2001 5:58 PM
To: PEN-TEST () SECURITYFOCUS COM
Subject: [PEN-TEST] MAC -> IP ?


Hi,

i am watching our net for changes in IP and MAC (which we don't allow). On
out Switch i can find a MAC, with no known IP. I already tried to ping the
whole IP range and looked in the arp table of my computer, but can't find
the MAC there. If i flush the switch arp table, the MAC comes back after
some seconds, so the 'evil' computer seems to be active.

1. is there a better way to get the IP if i have the MAC ?

2. how is it possible to hide your arp requests/response ?

thanks, Jens