when last we saw our hero (Thursday, Apr 22, 2004), 
 Jeffery Rasmussen was madly tapping out:
> 
> I have seen MAC addresses when I run etherape but I believe etherape
> uses ethereal to pick up its information.

if you have decent switching infrastructure you should be able to
pinpoint the port and the vlan that the mac address is showing up on.  

when you have that information you can snake your way back through the
switches and the wiring to find the offending device.  this works
regardless of the L3 protocol in use.  

from an ios based switch in my lab...

mgmt-sw2#sh mac-address-table dynamic 
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
  10    0005.ddc0.9901    DYNAMIC     Fa0/18
  10    000d.6535.ec71    DYNAMIC     Fa0/2
  10    000f.249a.43a0    DYNAMIC     Fa0/1
  10    0030.194c.9f00    DYNAMIC     Fa0/23
  10    00d0.ba04.d6ab    DYNAMIC     Gi0/1
  10    0800.20a0.576b    DYNAMIC     Gi0/1
   1    0050.538d.2800    DYNAMIC     Fa0/16


if i wanted to put the smack down on the device with mac address
0030.194c.9f00  on fa0/23 but i had several devices strung off that
port on the switch, i'd put a mac-address acl in place.  then start
the manual and painful hunt for the offending device.  if there's a
mess of hubs and such strung together start the binary tree search for
the device with a laptop and access to yank cables.  let this be a
lesson as to why flat L2 networks are bad things. ;-)

here's a config snippet for the mac acl.

mac access-list extended foo
 deny   host 0030.194c.9f00 any
!
interface FastEthernet0/23
 description -> c6400-2-nsp - e0/0/0
 switchport access vlan 10
 switchport mode access
 mac access-group foo in
 spanning-tree portfast
!

if you lack switching infrastructure capable of doing something along
these lines ... well, i'm sorry.

 
> -----Original Message-----
> From: Brian [mailto:lxy at cloudnet.com]
> Sent: Thursday, April 22, 2004 2:19 PM
> To: tclug-list at mn-linux.org
> Subject: [TCLUG] Tracking down a MAC address
> 
> 
> The other day we had a NIC broadcasting some bogus IPX SAP info.  I
> got the MAC address because our Netware servers were all displaying
> the MAC info while complaining.
> 
> Using all the tools at hand, I was unable to track it down.  I
> viewed the router's ARP table, no luck there.  I narrowed it down to
> one ethernet segment and strated up ethereal.  No luck, this MAC
> address wasn't showing up anywhere.
> 
> Is there a good tool to view all the MAC addresses connected to a
> specific segment?

{ snipped - misc .signatures }

-- 
steve ulrich                       sulrich at botwerks.org
PGP: 8D0B 0EE9 E700 A6CF ABA7  AE5F 4FD4 07C9 133B FAFC

_______________________________________________
TCLUG Mailing List - Minneapolis/St. Paul, Minnesota
http://www.mn-linux.org tclug-list at mn-linux.org
https://mailman.real-time.com/mailman/listinfo/tclug-list