[svlug] arpwatch

[Ze'ev Maor]

On Tue, Nov 10, 1998 at 05:11:02PM -0800, Alvin Oga wrote:
> what does it mean when arpwatch catches and reports
> a (new) IP#/MAC address of the ethernet cards on
> our local LAN for domain names we don't support ???
Can you post the exact message you receive? The IP->MAC resolution is done
automagically in response to a packet addressed locally (not routed out of the
LAN), then due to the broadcast nature of the ethernet protocol, all the MACs
on the segment "trap" the query, and the one that matches the requested IP
responds and thus a new ARP entry is created (of-course this is done on a
higher software level). I'm not sure where the domain part comes into the game, 
hence my request for the exact message format.

-- 
 -------------------------------------------------------------------------
| Ze'ev Maor		    | "We all have a little Daemon inside...      |
| gmaor at tx.technion.ac.il   |  ...Craving to come out and become a kernel"|
 -------------------------------------------------------------------------

--
echo "unsubscribe svlug" | mail majordomo at svlug.org
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ to unsubscribe