ARP originator identification

[natkennedy]

Description: Locating the source IP (or MAC) address of a station on any particular subnet that is directing ARP requests to a router to discover all stations on a separate subnet.
- typical of "device discovery" applications

Problem: the ARP originating station is difficult to locate because its ARP destination address is the "individual" address of a router, not a "group" broadcast address.

The router then broadcasts the ARPs on the requested subnet, but the source has now become the router, not the originating station

How does one identify the originating station?

Thank you

Nat Kennedy

 

[ProLific]

hmmm, well in a packet the router mac address becomes source, and uses stations to find destination. anyways, im sure your gonna have to be on that subnet to find the mac of the station, so if you can get to a station on the subnet, open command promt and enter (arp -a) to get arp table

 

[ProLific]

*uses stations network address (IP addy)