Penetration Testing mailing list archives

Re: [PEN-TEST] MAC -> IP ?


From: H D Moore <hdm () SECUREAUSTIN COM>
Date: Sun, 18 Mar 2001 23:24:52 -0600

Try arping:

http://freshmeat.net/projects/arping/

-HD

On Saturday 17 March 2001 04:57 pm, Kerle, Jens wrote:
Hi,

i am watching our net for changes in IP and MAC (which we don't allow). On
out Switch i can find a MAC, with no known IP. I already tried to ping the
whole IP range and looked in the arp table of my computer, but can't find
the MAC there. If i flush the switch arp table, the MAC comes back after
some seconds, so the 'evil' computer seems to be active.

1. is there a better way to get the IP if i have the MAC ?

2. how is it possible to hide your arp requests/response ?

thanks, Jens


Current thread: