RE: Arpwatch (was : mac addresses)
On Wed, 2003-07-30 at 01:13, Joyce, Matthew wrote:
> I have being running Arpwatch now for a couple of days and I am getting an
> awful lot of emails about the Macintosh devices we have here.
>
> hostname: <unknown>
> ip address: 0.0.0.0
> ethernet address: 0:3:93:53:fe:7e
> ethernet vendor: Apple Computer, Inc.
> old ethernet address: 0:3:93:93:df:36
> old ethernet vendor: Apple Computer, Inc.
> timestamp: Wednesday, July 30, 2003 9:00:40 +1000
> previous timestamp: Wednesday, July 30, 2003 8:53:49 +1000
> delta: 6 minutes
>
> I have heaps of these, mostly the ip is 0.0.0.0
> Any ideas ?
Yep... Appletalk over Ethernet... but not over IP. So they are arping
the Appletalk stuff. Seen a ton in previous gigs.
--
greg, greg@gregfolkert.net
REMEMBER ED CURRY! http://www.iwethey.org/ed_curry
The holes in your earloabs ever make me think fondly of the pock-marked
landscapes upon the lunar surface.
Reply to: