[LARTC] Terrible problem, some men in my net changed their MACs! :/

[Krystian Antoni]

here is my one cent :-)

propably somebody is changing a MAC so you DHCP will grant them specific IP. 


u can try nmap them them to see whos behind that MAC (at the moment where 
there is only one station turned on). then by using unplug and 
seek-the-hacker method u can find from what switch/port he's comming.
if u posses administrable switch it can be much easyier.

if u must verify every user, turn to pptp.

On 5/30/05, Konrad <kcem at tlen.pl> wrote:
> 
> Is any way to detect changed MAC adresses?
> 
> Someone taught change MACs peoples in my network and I have problems.
> 
> E.g. Two computers working on one MAC, and one IP (static ARP and DHCP).
> WinXP is screaming some message... that two computers or more have the
> same IP.
> 
> How can I find out who's changed MAC?
> _______________________________________________
> LARTC mailing list
> LARTC at mailman.ds9a.nl
> http://mailman.ds9a.nl/cgi-bin/mailman/listinfo/lartc
> 



-- 
Miłego Dnia
Krystian Antoni
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ds9a.nl/pipermail/lartc/attachments/20050530/4248d87d/attachment.htm