From: Fred Ingham (fningham@xxxxxxxxxxxxxxxx)
Date: Sun Aug 12 2001 - 21:58:51 GMT-3
Xuan: Capture some packets and look at the source MAC address. If it
is a router address then you don't want to filter it. Do a trace and
find the last router/switch before the host. Then look at arp or cam
entries to locate it.
If you have DHCP running on the network the host is probably getting its
address from it. Look at logs. Oft times a "malicious" host is simply
one with a bad NIC.
There are some other tools if you are using token-ring.
HTH, Fred
Xuan.Sun@Seagate.com wrote:
>
> A malicious machine always uses different IP addresses to connect to the
> network. Does anybody know how to disable this machine ? Is there a way to
> use MAC address-type of access list to filter this machine in the router
> before we physically find it ?
> **Please read:http://www.groupstudy.com/list/posting.html
**Please read:http://www.groupstudy.com/list/posting.html
This archive was generated by hypermail 2.1.4 : Thu Jun 13 2002 - 10:31:50 GMT-3