From owner-freebsd-questions@FreeBSD.ORG Tue Sep 28 03:25:54 2004 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 11C0516A4CE for ; Tue, 28 Sep 2004 03:25:54 +0000 (GMT) Received: from mail.freebsd-corp-net-guide.com (mail.freebsd-corp-net-guide.com [65.75.192.90]) by mx1.FreeBSD.org (Postfix) with ESMTP id 7FED543D2D for ; Tue, 28 Sep 2004 03:25:53 +0000 (GMT) (envelope-from tedm@toybox.placo.com) Received: from tedwin2k (nat-rtr.freebsd-corp-net-guide.com [65.75.197.130]) i8S3Pmq38914; Mon, 27 Sep 2004 20:25:48 -0700 (PDT) (envelope-from tedm@toybox.placo.com) From: "Ted Mittelstaedt" To: "russell" , "bsdfsse" Date: Mon, 27 Sep 2004 20:25:48 -0700 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0) X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 Importance: Normal In-Reply-To: <253578F8-1047-11D9-83E5-000A95DA456C@slofith.org> cc: "freebsd-questions@FreeBSD.ORG" Subject: RE: IP address conflicts X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Sep 2004 03:25:54 -0000 > -----Original Message----- > From: owner-freebsd-questions@freebsd.org > [mailto:owner-freebsd-questions@freebsd.org]On Behalf Of russell > Sent: Sunday, September 26, 2004 10:36 PM > To: bsdfsse > Cc: freebsd-questions@FreeBSD.ORG > Subject: Re: IP address conflicts > > > or use a tool like arpwatch that is specifically designed to let you > know when MAC/IP relationships change on your network. > You don't even need to do that - any router on the network is going to log the MAC address because they will see the arp change, as will the other servers. > you log the MAC addresses of all the fixed workstations in the school, > then when one of them starts doing the wrong thing you know *exactly* > where to go to nab the culprit. How, exactly? Do you think that he has a list of all MAC addresses on the network and who is using them? Getting the MAC address is not the problem. Finding it on what is essentially a completely flat network is. You need managed switches for this so you can see what port the offending MAC address is on. > If it's not one of the fixed > workstations then you've got a bit more work to find the kiddie, but > it's nothing insurmountable. > Unless of course the kiddies are using made up MAC addresses like BADBEEF, DEADBEEF, CO1DCOED, and such. Ted