View Single Post
  #6   (View Single Post)  
Old 2nd June 2010
J65nko J65nko is offline
Administrator
 
Join Date: May 2008
Location: Budel - the Netherlands
Posts: 3,503
Default

You could look at the MAC addresses, which reveal the manufacturer of the network device
Code:
$ arp -an
? (10.0.0.138) at 00:90:d0:83:06:7a on xl0
? (192.168.222.10) at 00:08:c7:05:ca:0b on fxp0 static
? (192.168.222.20) at 00:19:db:47:b0:4c on fxp0
? (192.168.222.33) at 00:11:d8:f1:dd:99 on fxp0
? (192.168.222.250) at (incomplete) on fxp0
Then you retrieve http://standards.ieee.org/regauth/oui/oui.txt

The first MAC from my ARP list is 00:90:d0:83:06:7a. Searching the oui.txt file for 00-90-D0
Code:
00-90-D0   (hex)		Thomson Telecom Belgium
0090D0     (base 16)		Thomson Telecom Belgium
As last example the 00:11:d8:f1:dd:99 address:
Code:
00-11-D8   (hex)		ASUSTek Computer Inc.
0011D8     (base 16)		ASUSTek Computer Inc.
__________________
You don't need to be a genius to debug a pf.conf firewall ruleset, you just need the guts to run tcpdump
Reply With Quote