Recent content by jdavis1

The IEEE assigns and maintains the MAC addresses. Here is their site. You can either look up a single prefix or download the entire list http://standards.ieee.org/regauth/oui/index.shtml

You need a CSU/DSU and a router, or a router with an integral CSU. Typically the CSU will hand off the T1 data to your CPE equipment as a V.35 serial interface. If you are running 2 T1's you are probably going to either want to load balance or imux them together to look like a single pipe. Just...

Force http traffic through an http proxy server. Almost every proxy implementation will log and report the information you are looking for. Cisco firewalls will also log this information to a syslog server.

A simplistic but understandable explanation: http://www.securesphere.net/download/papers/dnsspoof.htm

The only way you can capture traffic on any network is to put a packet capture device where the traffic is flowing. So you would need to get access to ISP network devices in order to do this. I'm not sure that is how people "hack" email addresses. It would seem that there would be easier ways...

I think what you are asking is if you can capture traffic to and from a particular host using a separate device. That depends on the capabilities of your switches. You need to be able to mirror the traffic from the monitored host on another port on the switch / network. Most enterprise class...

Additional information. I did a little further analysis on the capture. First, I checked the time between burst of unicast arps from the server. They seem to be somewhat random, but definately seem to be controlled by a timer. Times between bursts are 2.5 seconds, 5 seconds, 9 seconds, 10...

G, Thanks for the reply. This doesn't appear to be any sort of arp cache poisoning technique. The unicast arp packets contain the correct source MAC (both in the header and arp payload) and IP. As I said, the destination MAC corresponds to the machine that is assigned the IP address...

Recently a new W2K3 file server was deployed on a LAN that I manage. Since the deployment, users on the LAN have complained of poor performance when using services on the new server. I mirrored the port and discovered that the new server was sending a massive number of ARP requests...

Thanks Rudy. I had the impression that the firmware was a bit out of date. Call me a coward, but ultimately, I think I am going to have my colleague at the site do some rearranging of the 3Com, Bay, and Cisco switches at the site and connect his single Cisco switch to the router.

Hi all.... I'm a Cisco guy trying to work with a 3Com switch 4400. First off, let me define what I mean by the term "trunk". Cisco refers to trunks as lines that carry multiple VLANs. 3Com seems to refer to trunks as port aggregation groups. I am using the Cisco definition of a single...

Thanks for the reply. These switches are SuperStack 3300's, which were designed and built before LACP came about. Did that capability get added to that switch in later software releases? Yes, the newer versions of Cisco IOS and CatOS all support 802.3AD. I'm much more familiar with the...

Does anyone know if the 3Com "Port Trunk" link aggregation is compatible with Generic Link Aggregation on NICs with the Broadcom chipset? If you can't answer this, can you tell me if 3Com's "Port Trunk" link aggregation is compatible with Cisco's EtherChannel link aggregation? Thanks

I would tend to agree that in general a 70 workstation network would not need to be subnetted unless you have a very high level of broadcast traffic. In this case I would try to fix the broadcast problem rather than subnet. However, to try and answer some of your questions: First of all, you...

Nope... sorry. What you see here is what you get. If you come across a solution, I'd be interested in learning what it was.