Multiple IP's with same MAC Address

Protecting your Linux box

Multiple IP's with same MAC Address

Postby sevensins » Tue Jul 24, 2007 4:00 pm

AOA,

on my network I have 4 subnets. People on one subnet add the other subnet free ip address to bypass the gateway (lynx box). e.g
# arp -aven | grep 00:16:76:94:49:BB
192.168.59.38 ether 00:16:76:94:49:BB C eth0
192.168.79.50 ether 00:16:76:94:49:BB C eth0


I was wondering is there any way to find out duplicate hosts (ip's) with same mac address?

Any help, guidance would be much appreciated.
Regards,

-----------------------------------------------------------------
A wise monkey never monkies w/ another monkey's monkey!
sevensins
Havaldaar
 
Posts: 117
Joined: Tue Apr 13, 2004 1:45 pm
ICQ: 3655945
Website: http://www.us-cert.gov/
WLM: shehzad_h@hotmail.com
Yahoo Messenger: shehzadhamid@yahoo.com
Location: PAKISTAN

Re: Multiple IP's with same MAC Address

Postby lambda » Tue Jul 24, 2007 5:14 pm

sevensins wrote:I was wondering is there any way to find out duplicate hosts (ip's) with same mac address?
sure. here's a little script to help you out:

Code: Select all

#!/usr/bin/env ruby

reg = Regexp.new /^([0-9.]+)\s+\w+\s+([0-9A-F:]+)/
macs = {}

f = IO.popen '/usr/sbin/arp -aven'
f.each_line do |line|
  matches = reg.match line
  if matches
    ip = matches[1]
    ether = matches[2]
    if macs[ether]
      macs[ether] << ip
    else
      macs[ether] = [ip]
    end
  end
end

macs.each { |mac, iplist| puts "#{mac} has more than one ip: #{iplist}" if iplist.size > 1 }

exit 0
lambda
Major General
 
Posts: 3452
Joined: Tue May 27, 2003 7:04 pm
Website: http://www.hungry.com/~fn/
Location: Lahore

Postby sevensins » Mon Jul 30, 2007 10:29 am

thanx a lot, I will try it...
Regards,



-----------------------------------------------------------------

A wise monkey never monkies w/ another monkey's monkey!
sevensins
Havaldaar
 
Posts: 117
Joined: Tue Apr 13, 2004 1:45 pm
ICQ: 3655945
Website: http://www.us-cert.gov/
WLM: shehzad_h@hotmail.com
Yahoo Messenger: shehzadhamid@yahoo.com
Location: PAKISTAN

Postby raheelahmad » Thu Nov 01, 2007 4:11 pm

nice one
-
Raheel Ahmad
raheelahmad
Naik
 
Posts: 87
Joined: Tue Mar 06, 2007 4:58 am
WLM: ahmad.raheel@hotmail.com
Yahoo Messenger: ahmad.raheel@yahoo.com
Location: Karachi


Return to “%s” Security

Who is online

Users browsing this forum: No registered users and 2 guests

cron