bmn? ? ?Premium,ExMod 2003-06
join:2001-03-15
hiatus | reply to tekmunki
Re: Cisco ASDM Log (Deny Reverse Path Check) »forums.cisco.com/eforum/servlet/···1dd9020e
As for tracking it down... You could try logging into the CLI of the ASA, get the MAC address (it should have it in it's cache) and then do a lookup of the manufacturer. Assuming you have managed switches, you can then login to the various switches and track the MAC address down to a specific switch port.
Used to do this kind of stuff all the time. We wouldn't know the exact location of a system, so we would follow the ports where the MAC address is showing up back to the last switch and we would find the port it is attached to.
--
Prove it...
Save the Internet Time (NTP) service, use the pool. |
|
 tekmunkiTekmunkiPremium
join:2001-12-06
Lake City, FL | "show arp" didn't give me anything related to the 169 addresses, what other method did you have in mind to find the mac?
I can easily track the mac down if I can find it. 
--
TekMunki
"There are 10 types of people in this world, those who understand binary and those who don't."
www.tekmunki.com |
|
bmn? ? ?Premium,ExMod 2003-06
join:2001-03-15
hiatus
1 edit | said by tekmunki:"show arp" didn't give me anything related to the 169 addresses, what other method did you have in mind to find the mac? I can easily track the mac down if I can find it. You will need a hub that you can place between all the uplinks to the router and the actual router itself. You will then need to download Wireshark ( »www.wireshark.org/ ) and capture packets from the wire in promiscuous mode to grab the MAC address.
If you don't have a hub, you'll have to use port mirroring. Port mirroring is the preferred method, BTW, as it will cause the least amount of disruption to the network.
Ignore the port mirroring part... Just realized you are using an ASA and it doesn't have the ports to do it IIRC (you need at least TWO on the LAN side).
--
Prove it...
Save the Internet Time (NTP) service, use the pool. |
|
