From owner-freebsd-questions@FreeBSD.ORG Mon Mar 23 20:32:10 2009 Return-Path: Delivered-To: FreeBSD-Questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 1D086106567B for ; Mon, 23 Mar 2009 20:32:10 +0000 (UTC) (envelope-from dkelly@Grumpy.DynDNS.org) Received: from smtp.knology.net (smtp.knology.net [24.214.63.101]) by mx1.freebsd.org (Postfix) with ESMTP id B967B8FC25 for ; Mon, 23 Mar 2009 20:32:09 +0000 (UTC) (envelope-from dkelly@Grumpy.DynDNS.org) Received: (qmail 31431 invoked by uid 0); 23 Mar 2009 20:32:08 -0000 Received: from unknown (HELO Grumpy.DynDNS.org) (75.76.211.79) by smtp7.knology.net with SMTP; 23 Mar 2009 20:32:08 -0000 Received: by Grumpy.DynDNS.org (Postfix, from userid 928) id 7CADB28429; Mon, 23 Mar 2009 15:32:08 -0500 (CDT) Date: Mon, 23 Mar 2009 15:32:08 -0500 From: David Kelly To: John Almberg Message-ID: <20090323203208.GA46734@Grumpy.DynDNS.org> References: <20090323191917.GA46373@Grumpy.DynDNS.org> <192DFF2A-632D-4DA8-9108-919DAE6872EB@identry.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <192DFF2A-632D-4DA8-9108-919DAE6872EB@identry.com> User-Agent: Mutt/1.4.2.3i Cc: FreeBSD-Questions@freebsd.org Subject: Re: utility that scans lan for client? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: FreeBSD-Questions@FreeBSD.org List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 23 Mar 2009 20:32:10 -0000 On Mon, Mar 23, 2009 at 03:41:55PM -0400, John Almberg wrote: > On Mar 23, 2009, at 3:19 PM, David Kelly wrote: > > >How about something as simple as "arp -a"? This lists the arp cache > >of machines recently heard by your machine. If you know the IP > >address of the machine in question and its not in your arp table, > >ping it. Then the MAC address will appear unless there is a router > >between here and there. > > H'mmm. This is also very interesting. > > nmap did not find this appliance, as it turns out. But arp -a did > found something on 192.168.1.107 (see below) > > server1 (192.168.1.106) at 0:13:d4:45:45:31 on en1 [ethernet] > server2 (192.168.1.107) at (incomplete) on en1 [ethernet] > server3 (192.168.1.108) at 0:23:12:f8:5e:fd on en1 [ethernet] > > I'm guessing this appliance (a Vonage phone adapter) is doing > something non-standard. No, its just ignoring pings. An incomplete entry in the ARP table says your machine tried to look up that address, creating an entry, but as of the moment the table was read the reply had not yet come back. Whatever router you are using is sure to have the Vonnage appliance in its ARP table. "Smart" network switches prevent your FreeBSD host from eavesdropping on the ARP packet exchange between Vonnage and router. Otherwise it would be in the arp table if the Vonnage has spoken recently to the router. -- David Kelly N4HHE, dkelly@HiWAAY.net ======================================================================== Whom computers would destroy, they must first drive mad.