Re: How to find hidden host within LAN

["Mark" <firewalladmin () bellsouth net>]

Is the IP address within a valid range on your network or are we talking
about a foreign IP altogether? 

Sounds like someone might have a personal firewall setup on their computer.
You can completely block that host from Internet access in IPTables by using
his mac and ip address. You should find out soon enough who it is when they
call the helpdesk complaining that they have no Internet access.

Depending on your LAN setup you may be able to check your mac tables on your
switches and narrow down your search from their. You can also see what
manufacturer made the network card (assuming it is not spoofed) here:

http://www.coffer.com/mac_find/


Good luck.

Mark


-----Original Message-----
From: firewall-wizards-bounces () listserv icsalabs com
[mailto:firewall-wizards-bounces () listserv icsalabs com] On Behalf Of
desant1 () tin it
Sent: Sunday, November 25, 2007 9:42 AM
To: firewall-wizards () listserv icsalabs com
Subject: [fw-wiz] How to find hidden host within LAN

Hi everybody
I'm using RH ES4 with iptables as gateway/firewall for my 
LAN.
In the last week i notice in the iptables logs that a host within 
my lan is doing a lot of traffic.
The destination/source address of the 
packets and the used port suggest that this host is using peerToPeer 
application (emule or similar).
The problem is that i'm not able to 
identify this host within my LAN:
I can see his IP address (192.168.x.
y) and i can find his mac address througth ARP, but i can't ping it and 
there is no host within my lan with this Mac address.
I can't 
traceroute it.
Can someone help me to find this hidden host?
_______________________________________________
firewall-wizards mailing list
firewall-wizards () listserv icsalabs com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards


_______________________________________________
firewall-wizards mailing list
firewall-wizards () listserv icsalabs com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards