Date: Sun, 15 Sep 2002 13:46:57 +1200 (NZST) From: Andrew McNaughton <andrew@scoop.co.nz> To: "Andrew G. Russell IV" <arussell@tyr.agrknives.com> Cc: freebsd-security@FreeBSD.ORG Subject: Re: Mac address of hacked machine... Message-ID: <20020915133649.L47805-100000@a2.scoop.co.nz> In-Reply-To: <20020914192323.A10984@bifrost.agrknives.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, 14 Sep 2002, Andrew G. Russell IV wrote: > I have a machine that is hitting me with "kali" packets every few minutes. > I've contacted the ISP, but they can't help unless I supply the MAC address. > > I've done tcpdump, I've arped, I suppose I don't know what I'm doing on this > one. I've read all the HOWTOS that I can find, even linux ones... I've > searched the archives, I guess I'm not asking the right question. > > I'm sure this will be a head smacker. > > Thanks for any help... And YES I am subscribed... ;-> Unless the attacker is on the same ethernet subnet, there's no way you can know the MAC address, and the ISP is either clueless or deliberately unhelpful. If the person you are talking to knows enough to make use of a MAC address, then they almost certainly know enough to know that you can't provide one based on traffic seen outside of their network. That said, it's quite possible that they are simply trying to follow something from a helpdesk manual without knowing what the information they are supposed to gather is about or for. If you're dealing with clueless helpdesk staff, then try asking for someone from their network operations team. they will need to be involved to solve the problem anyway. Do collect a tcpdump of the traffic demonstrating the problem, making sure that the timestamps are accurate, and that you tell the ISP what timezone you are in. The ISP should be able to identify which machine the IP address was assigned to at that point in time. Andrew McNaughton To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020915133649.L47805-100000>