mac address tracerouting..

[Bill McNAMARA_1]

Hi,
is there any way to figure out on which network a mac address is on.

I've got a strange networking component (not a complete TCP/IP stack) detected via a ping on my general lan whereas it should be on a private lan.

arp returns a 172 address, which traceroute can't reach. arp -a doesn't show the mac either.

I don't think the element is on the same subnet..

Later,
Bill

[U.SivaKumar_2 · Accepted solution]

Hi,
You are speaking about general LAN and private LAN . Are they inteconnected by routers ?. Then
you will not see the arp address of the private LAN host on general LAN host , but only the router's MAC address.

Is this router a firewall ?.

If you want to play with arp and sort out this
problem. you can have arpworks.exe from this
site.
http://packetstormsecurity.nl/Win/
It can trace MAC addresses between subnets.

If you want to use IP address based tracer ( particularly in firewall environments , where
UDP traceroute will not help you )
Then have this tcptraceroute utility.

http://michael.toren.net/code/tcptraceroute/

regards,
U.SivaKumar

[Donald Kok]

It is not realy clear to me. You found an adres by ping, and arp -a does not show it. How did you find the mac-adres in the first place.

Anyway, I would use a packet sniffer to find out about this component. Also there are lists available with manufacturars and mac-adres ranges. This gives an indication what kind of component it is. I attach such a list (it is not recent though, sorry)

[U.SivaKumar_2]

Hi,
You have the MAC address . So to figure out which is device ( vendor ) go to this page
and do a MAC-Vendor lookup ;-)

http://www.shmoo.com/tools/mac/


regards,
U.SivaKumar

[Bill McNAMARA_1]

The element is a Telecom Signaling Unit (by HP), that's discovered by a command called ss7TsuPing.. which more or less does a style of ping broadcast and detects TSUs by a mac addy.
There are no IPs associated to the mac - it's not an IP device. Usually it's connected to the host via a loopback cable through an undefined lan i/f. (ie no ip assigned to the lan i/f)
I've discovered using this ss7TsuPing that some clown connected their TSU to the general lan, causing my ss7TsuPing to detect his TSU.
It's not a critical problem, but confuses students when they see 3 TSUs instead of the 1 that they know is connected to the system via loopback.
Based on just the MAC I have no idea where the TSU is located in our network, and was trying to breakdown my search to particular machine rooms.. in any case, I was lucky, it was in the first machine root I looked in, and I found it based on going around all TSUs and looking for their MAC stickers, slapped the culprit on the back of the head and emailed everyone to tell them how silly he was (and warn them not to do the same).

Thanks for the hints, they'll possibly make the next search easier.

Later,
Bill